Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
Setup.exe

Overview

General Information

Sample name:Setup.exe
Analysis ID:1550454
MD5:5df7ccb72d4007e7fae710495b42de76
SHA1:0e38df6c075e5de92be6b99249d236089dac8d5b
SHA256:6c3e4398e3d563746b928bf359468f6baf416bf3f757ca789cdf7fab1f02a1b7
Infos:

Detection

Score:57
Range:0 - 100
Whitelisted:false
Confidence:100%

Compliance

Score:34
Range:0 - 100

Signatures

Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Creates multiple autostart registry keys
Found direct / indirect Syscall (likely to bypass EDR)
Machine Learning detection for sample
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Contains functionality for read data from the clipboard
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to dynamically determine API calls
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to shutdown / reboot the system
Contains functionality to simulate keystroke presses
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
EXE planting / hijacking vulnerabilities found
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found potential string decryption / allocating functions
IP address seen in connection with other malware
Installs a global mouse hook
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
OS version to string mapping found (often used in BOTs)
PE file contains an invalid checksum
PE file contains more sections than normal
PE file contains sections with non-standard names
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: CurrentVersion Autorun Keys Modification
Stores files to the Windows start menu directory
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

Process Tree

  • System is w10x64
  • Setup.exe (PID: 6140 cmdline: "C:\Users\user\Desktop\Setup.exe" MD5: 5DF7CCB72D4007E7FAE710495B42DE76)
    • chrome.exe (PID: 3756 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://pcapp.store/installing.php?guid=4D802742-3099-9C0E-C19B-2A23EA1FC420&winver=19045&version=fa.1092c&nocache=20241106122456.947&_fcid=1730911513052455 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)
      • chrome.exe (PID: 2144 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1924 --field-trial-handle=2216,i,9566765671550453842,14323694336698430932,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)
      • chrome.exe (PID: 7712 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5228 --field-trial-handle=2216,i,9566765671550453842,14323694336698430932,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)
      • chrome.exe (PID: 7724 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5276 --field-trial-handle=2216,i,9566765671550453842,14323694336698430932,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)
    • nswC086.tmp (PID: 7956 cmdline: "C:\Users\user\AppData\Local\Temp\nswC086.tmp" /internal 1730911513052455 /force MD5: 84EE733F8014D22DAD2DFEF725489980)
      • PcAppStore.exe (PID: 1756 cmdline: "C:\Users\user\PCAppStore\PcAppStore.exe" /init default MD5: 4B88D8ADA8D22622C30D581FC38EAA52)
        • explorer.exe (PID: 4004 cmdline: C:\Windows\Explorer.EXE MD5: 662F4F92FDE3557E86D110526BB578D5)
          • PcAppStore.exe (PID: 5728 cmdline: "C:\Users\user\PCAppStore\PCAppStore.exe" /init default MD5: 4B88D8ADA8D22622C30D581FC38EAA52)
        • MLLHdqUcwgfrtUaposkqsOihMsq.exe (PID: 3632 cmdline: "C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • MLLHdqUcwgfrtUaposkqsOihMsq.exe (PID: 5832 cmdline: "C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • MLLHdqUcwgfrtUaposkqsOihMsq.exe (PID: 6064 cmdline: "C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • MLLHdqUcwgfrtUaposkqsOihMsq.exe (PID: 4060 cmdline: "C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • MLLHdqUcwgfrtUaposkqsOihMsq.exe (PID: 356 cmdline: "C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • MLLHdqUcwgfrtUaposkqsOihMsq.exe (PID: 5872 cmdline: "C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • MLLHdqUcwgfrtUaposkqsOihMsq.exe (PID: 5008 cmdline: "C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • MLLHdqUcwgfrtUaposkqsOihMsq.exe (PID: 4160 cmdline: "C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • MLLHdqUcwgfrtUaposkqsOihMsq.exe (PID: 6868 cmdline: "C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • MLLHdqUcwgfrtUaposkqsOihMsq.exe (PID: 4200 cmdline: "C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • MLLHdqUcwgfrtUaposkqsOihMsq.exe (PID: 5484 cmdline: "C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • MLLHdqUcwgfrtUaposkqsOihMsq.exe (PID: 1060 cmdline: "C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • MLLHdqUcwgfrtUaposkqsOihMsq.exe (PID: 6884 cmdline: "C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • MLLHdqUcwgfrtUaposkqsOihMsq.exe (PID: 1096 cmdline: "C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • MLLHdqUcwgfrtUaposkqsOihMsq.exe (PID: 4988 cmdline: "C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • MLLHdqUcwgfrtUaposkqsOihMsq.exe (PID: 4932 cmdline: "C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • MLLHdqUcwgfrtUaposkqsOihMsq.exe (PID: 6392 cmdline: "C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • MLLHdqUcwgfrtUaposkqsOihMsq.exe (PID: 4608 cmdline: "C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • MLLHdqUcwgfrtUaposkqsOihMsq.exe (PID: 4824 cmdline: "C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • MLLHdqUcwgfrtUaposkqsOihMsq.exe (PID: 4388 cmdline: "C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • MLLHdqUcwgfrtUaposkqsOihMsq.exe (PID: 7092 cmdline: "C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • MLLHdqUcwgfrtUaposkqsOihMsq.exe (PID: 6620 cmdline: "C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • MLLHdqUcwgfrtUaposkqsOihMsq.exe (PID: 3652 cmdline: "C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • MLLHdqUcwgfrtUaposkqsOihMsq.exe (PID: 1424 cmdline: "C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • MLLHdqUcwgfrtUaposkqsOihMsq.exe (PID: 3568 cmdline: "C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • MLLHdqUcwgfrtUaposkqsOihMsq.exe (PID: 6452 cmdline: "C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • MLLHdqUcwgfrtUaposkqsOihMsq.exe (PID: 2924 cmdline: "C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
      • Watchdog.exe (PID: 7704 cmdline: "C:\Users\user\PCAppStore\Watchdog.exe" /guid=4D802742-3099-9C0E-C19B-2A23EA1FC420 /rid=20241106122556.806529687 /ver=fa.1092c MD5: 11F3801CB9FF046D6075F681971C4EB8)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
Process Memory Space: explorer.exe PID: 4004ironshell_phpSemi-Auto-generated - file ironshell.php.txtNeo23x0 Yara BRG + customization by Stefan -dfate- Molls
  • 0x15fa4e:$s2: ~ Shell I
  • 0x19816d:$s2: ~ Shell I

Sigma Signatures

System Summary

barindex
Sigma detected: CurrentVersion Autorun Keys Modification
Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Users\user\PCAppStore\PCAppStore.exe" /init default, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\nswC086.tmp, ProcessId: 7956, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PCAppStore

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpReversingLabs: Detection: 45%
Source: C:\Users\user\PCAppStore\Uninstaller.exeReversingLabs: Detection: 29%
Source: C:\Users\user\PCAppStore\download\Setupuser.exeReversingLabs: Detection: 18%
Machine Learning detection for sample
Source: Setup.exeJoe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpEXE: C:\Users\user\PCAppStore\Watchdog.exeJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpEXE: C:\Users\user\PCAppStore\Uninstaller.exeJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpEXE: C:\Users\user\PCAppStore\nwjs\NW_store.exeJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpEXE: C:\Users\user\PCAppStore\PcAppStore.exeJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpEXE: C:\Users\user\PCAppStore\nwjs\notification_helper.exeJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpEXE: C:\Users\user\PCAppStore\AutoUpdater.exeJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeEXE: C:\Users\user\PCAppStore\download\Setupuser.exeJump to behavior
Source: https://pcapp.store/?p=lpd_installing_r2&guid=4D802742-3099-9C0E-C19B-2A23EA1FC420&_fcid=1730911513052455&_winver=19045&version=fa.1092cHTTP Parser: No favicon
Source: https://pcapp.store/?p=lpd_installing_r2&guid=4D802742-3099-9C0E-C19B-2A23EA1FC420&_fcid=1730911513052455&_winver=19045&version=fa.1092cHTTP Parser: No favicon
Source: https://pcapp.store/?p=lpd_installing_r2&guid=4D802742-3099-9C0E-C19B-2A23EA1FC420&_fcid=1730911513052455&_winver=19045&version=fa.1092cHTTP Parser: No favicon
Source: https://pcapp.store/?p=lpd_installing_r2&guid=4D802742-3099-9C0E-C19B-2A23EA1FC420&_fcid=1730911513052455&_winver=19045&version=fa.1092cHTTP Parser: No favicon

Compliance

barindex
EXE planting / hijacking vulnerabilities found
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpEXE: C:\Users\user\PCAppStore\Watchdog.exeJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpEXE: C:\Users\user\PCAppStore\Uninstaller.exeJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpEXE: C:\Users\user\PCAppStore\nwjs\NW_store.exeJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpEXE: C:\Users\user\PCAppStore\PcAppStore.exeJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpEXE: C:\Users\user\PCAppStore\nwjs\notification_helper.exeJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpEXE: C:\Users\user\PCAppStore\AutoUpdater.exeJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeEXE: C:\Users\user\PCAppStore\download\Setupuser.exeJump to behavior
Uses 32bit PE files
Source: Setup.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Creates a software uninstall entry
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpRegistry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PCAppStoreJump to behavior
Creates license or readme file
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpFile created: C:\Users\user\PCAppStore\ui\static\js\2.801b9d83.chunk.js.LICENSE.txtJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpFile created: C:\Users\user\PCAppStore\ReadMe.txtJump to behavior
PE / OLE file has a valid certificate
Source: Setup.exeStatic PE information: certificate valid
Contains modern PE file flags such as dynamic base (ASLR) or NX
Source: Setup.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Binary contains paths to debug symbols
Source: Binary string: C:\Build\Build_1092c_D20241025T171023\fa_rss\Watchdog\x64\Release\Watchdog.pdb source: nswC086.tmp, 00000009.00000002.2911981644.0000000002799000.00000004.00000020.00020000.00000000.sdmp, Watchdog.exe, 0000000C.00000002.3396323103.00007FF70D32A000.00000002.00000001.01000000.00000017.sdmp, Watchdog.exe, 0000000C.00000000.2783135227.00007FF70D32A000.00000002.00000001.01000000.00000017.sdmp
Source: Binary string: C:\Build\Build_1092c_D20241025T171023\fa_rss\AppStoreUpdater\Release\auto_updater.pdb1 source: nswC086.tmp, 00000009.00000002.2911981644.0000000002E84000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: MLLHdqUcwgfrtUaposkqsOihMsq.exe, 0000000F.00000002.3374146882.00000000005EE000.00000002.00000001.01000000.0000001A.sdmp, MLLHdqUcwgfrtUaposkqsOihMsq.exe, 00000011.00000000.2844362360.00000000005EE000.00000002.00000001.01000000.0000001A.sdmp, MLLHdqUcwgfrtUaposkqsOihMsq.exe, 00000012.00000002.3373624705.00000000005EE000.00000002.00000001.01000000.0000001A.sdmp, MLLHdqUcwgfrtUaposkqsOihMsq.exe, 00000013.00000000.2848958846.00000000005EE000.00000002.00000001.01000000.0000001A.sdmp, MLLHdqUcwgfrtUaposkqsOihMsq.exe, 00000014.00000002.3373622299.00000000005EE000.00000002.00000001.01000000.0000001A.sdmp, MLLHdqUcwgfrtUaposkqsOihMsq.exe, 00000015.00000002.3373639542.00000000005EE000.00000002.00000001.01000000.0000001A.sdmp, MLLHdqUcwgfrtUaposkqsOihMsq.exe, 00000016.00000002.3373641601.00000000005EE000.00000002.00000001.01000000.0000001A.sdmp, MLLHdqUcwgfrtUaposkqsOihMsq.exe, 00000017.00000000.2870418243.00000000005EE000.00000002.00000001.01000000.0000001A.sdmp, MLLHdqUcwgfrtUaposkqsOihMsq.exe, 00000018.00000002.3373635159.00000000005EE000.00000002.00000001.01000000.0000001A.sdmp, MLLHdqUcwgfrtUaposkqsOihMsq.exe, 00000019.00000000.2884084960.00000000005EE000.00000002.00000001.01000000.0000001A.sdmp, MLLHdqUcwgfrtUaposkqsOihMsq.exe, 0000001A.00000000.2885428722.00000000005EE000.00000002.00000001.01000000.0000001A.sdmp, MLLHdqUcwgfrtUaposkqsOihMsq.exe, 0000001B.00000000.2886851797.00000000005EE000.00000002.00000001.01000000.0000001A.sdmp, MLLHdqUcwgfrtUaposkqsOihMsq.exe, 0000001C.00000000.2888324770.00000000005EE000.00000002.00000001.01000000.0000001A.sdmp, MLLHdqUcwgfrtUaposkqsOihMsq.exe, 0000001D.00000000.2890285748.00000000005EE000.00000002.00000001.01000000.0000001A.sdmp, MLLHdqUcwgfrtUaposkqsOihMsq.exe, 0000001E.00000000.2892336343.00000000005EE000.00000002.00000001.01000000.0000001A.sdmp, MLLHdqUcwgfrtUaposkqsOihMsq.exe, 0000001F.00000002.3373644984.00000000005EE000.00000002.00000001.01000000.0000001A.sdmp, MLLHdqUcwgfrtUaposkqsOihMsq.exe, 00000020.00000000.2900995106.00000000005EE000.00000002.00000001.01000000.0000001A.sdmp, MLLHdqUcwgfrtUaposkqsOihMsq.exe, 00000021.00000002.3385667765.00000000005EE000.00000002.00000001.01000000.0000001A.sdmp, MLLHdqUcwgfrtUaposkqsOihMsq.exe, 00000022.00000000.2910127313.00000000005EE000.00000002.00000001.01000000.0000001A.sdmp, MLLHdqUcwgfrtUaposkqsOihMsq.exe, 00000023.00000002.3373628885.00000000005EE000.00000002.00000001.01000000.0000001A.sdmp, MLLHdqUcwgfrtUaposkqsOihMsq.exe, 00000025.00000002.3373632413.00000000005EE000.00000002.00000001.01000000.0000001A.sdmp, MLLHdqUcwgfrtUaposkqsOihMsq.exe, 00000026.00000002.3373625884.00000000005EE000.00000002.00000001.01000000.0000001A.sdmp, MLLHdqUcwgfrtUaposkqsOihMsq.exe, 00000027.00000000.2921015277.00000000005EE000.00000002.00000001.01000000.0000001A.sdmp, MLLHdqUcwgfrtUaposkqsOihMsq.exe, 00000028.00000000.2922273203.00000000005EE000.00000002.00000001.01000000.0000001A.sdmp, MLLHdqUcwg
Source: Binary string: C:\Users\zak\Downloads\Inetc\Unicode\Plugins\inetc.pdb source: Setup.exe, 00000000.00000002.2413568462.000000000040A000.00000004.00000001.01000000.00000003.sdmp
Source: Binary string: C:\Build\Build_1092c_D20241025T171023\fa_rss\user\Release\PCAppStore.pdb source: nswC086.tmp, 00000009.00000002.2911981644.0000000002B8D000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000000B.00000000.2782815097.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000024.00000000.2913689767.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000024.00000002.2920899777.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmp
Source: Binary string: C:\Build\Build_1092c_D20241025T171023\fa_rss\AppStoreUpdater\Release\auto_updater.pdb source: nswC086.tmp, 00000009.00000002.2911981644.0000000002E84000.00000004.00000020.00020000.00000000.sdmp
Source: C:\Users\user\Desktop\Setup.exeCode function: 0_2_00405C49 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,0_2_00405C49
Source: C:\Users\user\Desktop\Setup.exeCode function: 0_2_00406873 FindFirstFileW,FindClose,0_2_00406873
Source: C:\Users\user\Desktop\Setup.exeCode function: 0_2_0040290B FindFirstFileW,0_2_0040290B
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpCode function: 9_2_00405D74 CloseHandle,GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,9_2_00405D74
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpCode function: 9_2_0040699E FindFirstFileW,FindClose,9_2_0040699E
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpCode function: 9_2_0040290B FindFirstFileW,9_2_0040290B
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 11_2_00007FF72FBC75F8 FindClose,FindFirstFileExW,GetLastError,GetCurrentDirectoryW,GetLastError,11_2_00007FF72FBC75F8
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 11_2_00007FF72FBC76A8 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,__std_fs_open_handle,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,CloseHandle,CloseHandle,11_2_00007FF72FBC76A8
Source: C:\Users\user\PCAppStore\Watchdog.exeCode function: 12_2_00007FF70D3116E0 FindClose,FindFirstFileExW,GetLastError,12_2_00007FF70D3116E0
Source: C:\Users\user\PCAppStore\Watchdog.exeCode function: 12_2_00007FF70D311754 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,__std_fs_open_handle,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,CloseHandle,CloseHandle,12_2_00007FF70D311754
Source: C:\Users\user\PCAppStore\Watchdog.exeCode function: 12_2_00007FF70D320330 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,12_2_00007FF70D320330
Source: Joe Sandbox ViewIP Address: 147.182.211.77 147.182.211.77
Source: Joe Sandbox ViewIP Address: 161.35.127.181 161.35.127.181
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 11_2_00007FF72FA5CB80 GetTickCount64,Sleep,GetTickCount,Sleep,URLDownloadToFileW,Sleep,DeleteFileW,11_2_00007FF72FA5CB80
Source: chrome.exe, 00000003.00000002.3740597670.00002B3802831000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3740959914.00002B3802854000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: %https://www.youtube.com/?feature=ytca equals www.youtube.com (Youtube)
Source: chrome.exe, 00000003.00000002.3740597670.00002B3802831000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3740959914.00002B3802854000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: @https://www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)
Source: chrome.exe, 00000003.00000002.3740597670.00002B3802831000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3740959914.00002B3802854000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/: equals www.youtube.com (Youtube)
Source: chrome.exe, 00000003.00000002.3740597670.00002B3802831000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3740959914.00002B3802854000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/J equals www.youtube.com (Youtube)
Source: chrome.exe, 00000003.00000002.3734777832.00002B38024C0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)
Source: chrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/1423136
Source: chrome.exe, 00000003.00000002.3751750048.00002B3802D38000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/2162
Source: chrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/2517
Source: chrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/2970
Source: chrome.exe, 00000003.00000002.3751750048.00002B3802D38000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3078
Source: chrome.exe, 00000003.00000002.3751750048.00002B3802D38000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3078J
Source: chrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3205
Source: chrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3206
Source: chrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3206e
Source: chrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3206f
Source: chrome.exe, 00000003.00000002.3738506886.00002B38026EC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3452
Source: chrome.exe, 00000003.00000002.3751750048.00002B3802D38000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3502
Source: chrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3577
Source: chrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3584
Source: chrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3586
Source: chrome.exe, 00000003.00000002.3757797204.00002B3803240000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3623
Source: chrome.exe, 00000003.00000002.3757797204.00002B3803240000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3624
Source: chrome.exe, 00000003.00000002.3757797204.00002B3803240000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3625
Source: chrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3832
Source: chrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3832%
Source: chrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3862
Source: chrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3965
Source: chrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3970
Source: chrome.exe, 00000003.00000002.3739925519.00002B38027B8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/4324
Source: chrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/4405
Source: chrome.exe, 00000003.00000002.3751750048.00002B3802D38000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/4428
Source: chrome.exe, 00000003.00000002.3739925519.00002B38027B8000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/4551
Source: chrome.exe, 00000003.00000002.3751750048.00002B3802D38000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/4633
Source: chrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/4836
Source: chrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3738506886.00002B38026EC000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3752794412.00002B3802DD8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/4901
Source: chrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/4901ed8
Source: chrome.exe, 00000003.00000002.3738506886.00002B38026EC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/4901ocess
Source: chrome.exe, 00000003.00000002.3739925519.00002B38027B8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/4937
Source: chrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/5007
Source: chrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/5055
Source: chrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/5061
Source: chrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/5281
Source: chrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/5371
Source: chrome.exe, 00000003.00000002.3751750048.00002B3802D38000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/5375
Source: chrome.exe, 00000003.00000002.3751750048.00002B3802D38000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/5375M
Source: chrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/5421
Source: chrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/5421W
Source: chrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/5430
Source: chrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/5535
Source: chrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/5658
Source: chrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/5750
Source: chrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/5881
Source: chrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/5901
Source: chrome.exe, 00000003.00000002.3740865206.00002B380283C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/5906
Source: chrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/5906J
Source: chrome.exe, 00000003.00000002.3740865206.00002B380283C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/5906O
Source: chrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/5906T
Source: chrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/5906d
Source: chrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/5906g
Source: chrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/5906u
Source: chrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/5906w
Source: chrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/6041
Source: chrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/6048
Source: chrome.exe, 00000003.00000002.3740865206.00002B380283C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/6141
Source: chrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/6248
Source: chrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/6439
Source: chrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/6651
Source: chrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/6692
Source: chrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/6692:L
Source: chrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/6755
Source: chrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/6860
Source: chrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/6860M
Source: chrome.exe, 00000003.00000002.3751750048.00002B3802D38000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/6876
Source: chrome.exe, 00000003.00000002.3751750048.00002B3802D38000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/6876K
Source: chrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/6878
Source: chrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/6953
Source: chrome.exe, 00000003.00000002.3730818086.00002B380220C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/7036
Source: chrome.exe, 00000003.00000002.3751750048.00002B3802D38000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/7047
Source: chrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/7172
Source: chrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/7279
Source: chrome.exe, 00000003.00000002.3751750048.00002B3802D38000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/7406
Source: chrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/7488
Source: chrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/7488a
Source: chrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/7553
Source: chrome.exe, 00000003.00000002.3740865206.00002B380283C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/7556
Source: chrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/7724
Source: chrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/7761
Source: chrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3745991408.00002B38029B4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/8215
Source: chrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/8215b
Source: chrome.exe, 00000003.00000002.3751750048.00002B3802D38000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/8229
Source: chrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/8229(
Source: chrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3745991408.00002B38029B4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/8280
Source: chrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/8280ocess
Source: chrome.exe, 00000003.00000002.3733590482.00002B380240C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://clients2.google.com/time/1/current
Source: chrome.exe, 00000003.00000002.3738336166.00002B3802698000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=117
Source: chrome.exe, 00000003.00000002.3749028177.00002B3802B60000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://dl.google.com/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjhkYWYwZDctOTExOS00MGQ5LTgyNjAt
Source: chrome.exe, 00000003.00000002.3756198806.00002B3803124000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://dl.google.com/release2/chrome_component/V3P1l2hLvLw_7/7_all_sslErrorAssistant.crx3
Source: chrome.exe, 00000003.00000002.3756198806.00002B3803124000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://dl.google.com/release2/chrome_component/V3P1l2hLvLw_7/7_all_sslErrorAssistant.crx375//
Source: chrome.exe, 00000003.00000002.3749950020.00002B3802C0C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://dl.google.com/release2/chrome_component/ac6mhlwypzipnufijdvfyhdgvt4q_67/khaoiebndkojlmppeemjh
Source: chrome.exe, 00000003.00000002.3749028177.00002B3802B60000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://dl.google.com/release2/chrome_component/acaldksiunzh56452py2db5mnbpa_120.0.6050.0/jamhcnnkihi
Source: chrome.exe, 00000003.00000002.3749028177.00002B3802B60000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://dl.google.com/release2/chrome_component/acccxbt6wwsvpxzpob4hojndwkqq_4.10.2830.0/oimompecagna
Source: chrome.exe, 00000003.00000002.3732007335.00002B38022F0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://dl.google.com/release2/chrome_component/ad3skwo2srs5xchyxzz6ujgnedha_9.52.0/gcmjkmgdlgnkkcocm
Source: chrome.exe, 00000003.00000002.3749950020.00002B3802C0C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://dl.google.com/release2/chrome_component/adb2qwdrzgsbze5reot2ljihgpqa_9275/hfnkpimlhhgieaddgfe
Source: chrome.exe, 00000003.00000002.3767123957.00002B3803C6C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://dl.google.com/release2/chrome_component/adrga7eefaxjfdmmgfkiaxjg4yjq_2024.7.12.235938/eeigpng
Source: chrome.exe, 00000003.00000002.3746575735.00002B3802A38000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://dl.google.com/release2/chrome_component/b3n6bzc5iojg34kogsjitu53ou_20241024.690425616.14/obed
Source: chrome.exe, 00000003.00000002.3749028177.00002B3802B60000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://dl.google.com/release2/chrome_component/cpx7rw4q3nwu7emczqf2w6cu7y_2023.3.30.1305/cocncanleaf
Source: chrome.exe, 00000003.00000002.3732007335.00002B38022F0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://dl.google.com/release2/chrome_component/cxxqn654fg7hzrcrrnqcniqqye_2024.10.11.1/kiabhabjdbkjd
Source: chrome.exe, 00000003.00000002.3732007335.00002B38022F0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://dl.google.com/release2/chrome_component/e6xlmsu5i2bokri3w4cyuhv4nq_2024.8.10.0/gonpemdgkjcecd
Source: chrome.exe, 00000003.00000002.3732007335.00002B38022F0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://dl.google.com/release2/chrome_component/imoffpf67hel7kbknqflao2oo4_1.0.2738.0/neifaoindggfcji
Source: chrome.exe, 00000003.00000002.3732213913.00002B3802328000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://dl.google.com/release2/chrome_component/j2hxfei2occ5siitujtlwgp6xi_3/ojhpjlocmbogdgmfpkhlaaea
Source: chrome.exe, 00000003.00000002.3755363084.00002B380308C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://dl.google.com/release2/chrome_component/p2zbkxfgkqyr6ljey2oe3bnzoy_2023.11.29.1201/ggkkehgbnf
Source: chrome.exe, 00000003.00000002.3763448598.00002B380379C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://dns-tunnel-check.googlezip.net/connect
Source: chrome.exe, 00000003.00000002.3749950020.00002B3802C0C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvNzI0QUFXNV9zT2RvdUwy
Source: chrome.exe, 00000003.00000002.3749028177.00002B3802B60000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjhkYWYwZDctOTExOS00
Source: chrome.exe, 00000003.00000002.3749637074.00002B3802BD0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/AMpg5-cnrANo_2018.8.8.0/2018.8.8.0_win64_
Source: chrome.exe, 00000003.00000002.3757268228.00002B380321C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/V3P1l2hLvLw_7/7_all_sslErrorAssistant.crx
Source: chrome.exe, 00000003.00000002.3749028177.00002B3802B60000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/ac6mhlwypzipnufijdvfyhdgvt4q_67/khaoiebnd
Source: chrome.exe, 00000003.00000002.3767123957.00002B3803C6C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaldksiunzh56452py2db5mnbpa_120.0.6050.0
Source: chrome.exe, 00000003.00000002.3755363084.00002B380308C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acccxbt6wwsvpxzpob4hojndwkqq_4.10.2830.0/
Source: chrome.exe, 00000003.00000002.3732007335.00002B38022F0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/ad3skwo2srs5xchyxzz6ujgnedha_9.52.0/gcmjk
Source: chrome.exe, 00000003.00000002.3749028177.00002B3802B60000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adb2qwdrzgsbze5reot2ljihgpqa_9275/hfnkpim
Source: chrome.exe, 00000003.00000002.3749028177.00002B3802B60000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adohe7tf6ytr4v66tjma7zsnb3wq_1123/efniojl
Source: chrome.exe, 00000003.00000002.3755363084.00002B380308C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adrga7eefaxjfdmmgfkiaxjg4yjq_2024.7.12.23
Source: chrome.exe, 00000003.00000002.3732378949.00002B380234C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/b3n6bzc5iojg34kogsjitu53ou_20241024.69042
Source: chrome.exe, 00000003.00000002.3767123957.00002B3803C6C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/cpx7rw4q3nwu7emczqf2w6cu7y_2023.3.30.1305
Source: chrome.exe, 00000003.00000002.3767123957.00002B3803C6C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/cxxqn654fg7hzrcrrnqcniqqye_2024.10.11.1/k
Source: chrome.exe, 00000003.00000002.3767123957.00002B3803C6C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/e6xlmsu5i2bokri3w4cyuhv4nq_2024.8.10.0/go
Source: chrome.exe, 00000003.00000002.3767123957.00002B3803C6C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/imoffpf67hel7kbknqflao2oo4_1.0.2738.0/nei
Source: chrome.exe, 00000003.00000002.3749028177.00002B3802B60000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/kuv6sxh4r3bgt6ctayzn6cl44e_3049/jflookgnk
Source: chrome.exe, 00000003.00000002.3767123957.00002B3803C6C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/p2zbkxfgkqyr6ljey2oe3bnzoy_2023.11.29.120
Source: chrome.exe, 00000003.00000002.3731164079.00002B380228E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://google.com/
Source: chrome.exe, 00000003.00000002.3757797204.00002B3803240000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://issuetracker.google.com/200067929
Source: chrome.exe, 00000003.00000002.3629747706.000001A4D0477000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: http://localhost:64111/browseore/api/api.php8899~101878944~101925629&u_w=1280&u_h=1024&url=https%3A%
Source: chrome.exe, 00000003.00000002.3759803058.00002B3803314000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://localhost:64111/savescriptent%3Dgtag.config&rfmt=3&fmt=4
Source: Setup.exe, 00000000.00000000.2105153675.000000000040A000.00000008.00000001.01000000.00000003.sdmp, Setup.exe, 00000000.00000002.2413568462.000000000040A000.00000004.00000001.01000000.00000003.sdmp, nswC086.tmp, 00000009.00000002.2911981644.0000000002F15000.00000004.00000020.00020000.00000000.sdmp, nswC086.tmp, 00000009.00000000.2399914469.000000000040A000.00000008.00000001.01000000.0000000F.sdmp, nswC086.tmp, 00000009.00000002.2909567666.000000000040A000.00000004.00000001.01000000.0000000F.sdmp, PcAppStore.exe, 0000000B.00000003.3152892331.0000017814301000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000B.00000003.3153665242.000001781433C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: chrome.exe, 00000003.00000002.3749028177.00002B3802B60000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://redirector.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjhkYWYwZDctOTExOS0
Source: chrome.exe, 00000003.00000002.3749637074.00002B3802BD0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://redirector.gvt1.com/edgedl/release2/chrome_component/AMpg5-cnrANo_2018.8.8.0/2018.8.8.0_win64
Source: chrome.exe, 00000003.00000002.3757268228.00002B380321C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://redirector.gvt1.com/edgedl/release2/chrome_component/V3P1l2hLvLw_7/7_all_sslErrorAssistant.cr
Source: chrome.exe, 00000003.00000002.3749452474.00002B3802BA0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://safebrowsing.googleusercontent.com/safebrowsing/clientreport/chrome-certs
Source: chrome.exe, 00000003.00000002.3749452474.00002B3802BA0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://unisolated.invalid/
Source: chrome.exe, 00000003.00000002.3749028177.00002B3802B60000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.google.com/dl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjhkYWYwZDctOTExOS00MGQ5LTgy
Source: chrome.exe, 00000003.00000002.3746575735.00002B3802A38000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.google.com/dl/release2/chrome_component/AMpg5-cnrANo_2018.8.8.0/2018.8.8.0_win64_win_thir
Source: chrome.exe, 00000003.00000002.3756198806.00002B3803124000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.google.com/dl/release2/chrome_component/V3P1l2hLvLw_7/7_all_sslErrorAssistant.crx3
Source: chrome.exe, 00000003.00000002.3749950020.00002B3802C0C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.google.com/dl/release2/chrome_component/ac6mhlwypzipnufijdvfyhdgvt4q_67/khaoiebndkojlmppe
Source: chrome.exe, 00000003.00000002.3749028177.00002B3802B60000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.google.com/dl/release2/chrome_component/acaldksiunzh56452py2db5mnbpa_120.0.6050.0/jamhcnn
Source: chrome.exe, 00000003.00000002.3749028177.00002B3802B60000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.google.com/dl/release2/chrome_component/acccxbt6wwsvpxzpob4hojndwkqq_4.10.2830.0/oimompec
Source: chrome.exe, 00000003.00000002.3749028177.00002B3802B60000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.google.com/dl/release2/chrome_component/ad3skwo2srs5xchyxzz6ujgnedha_9.52.0/gcmjkmgdlgnkk
Source: chrome.exe, 00000003.00000002.3741627999.00002B3802880000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.google.com/dl/release2/chrome_component/adb2qwdrzgsbze5reot2ljihgpqa_9275/hfnkpimlhhgiead
Source: chrome.exe, 00000003.00000002.3767123957.00002B3803C6C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.google.com/dl/release2/chrome_component/adrga7eefaxjfdmmgfkiaxjg4yjq_2024.7.12.235938/eei
Source: chrome.exe, 00000003.00000002.3746575735.00002B3802A38000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.google.com/dl/release2/chrome_component/b3n6bzc5iojg34kogsjitu53ou_20241024.690425616.14/
Source: chrome.exe, 00000003.00000002.3767123957.00002B3803C6C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.google.com/dl/release2/chrome_component/cpx7rw4q3nwu7emczqf2w6cu7y_2023.3.30.1305/cocncan
Source: chrome.exe, 00000003.00000002.3732007335.00002B38022F0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.google.com/dl/release2/chrome_component/cxxqn654fg7hzrcrrnqcniqqye_2024.10.11.1/kiabhabjd
Source: chrome.exe, 00000003.00000002.3749028177.00002B3802B60000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3732007335.00002B38022F0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.google.com/dl/release2/chrome_component/e6xlmsu5i2bokri3w4cyuhv4nq_2024.8.10.0/gonpemdgkj
Source: chrome.exe, 00000003.00000002.3732007335.00002B38022F0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.google.com/dl/release2/chrome_component/imoffpf67hel7kbknqflao2oo4_1.0.2738.0/neifaoindgg
Source: chrome.exe, 00000003.00000002.3767123957.00002B3803C6C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.google.com/dl/release2/chrome_component/p2zbkxfgkqyr6ljey2oe3bnzoy_2023.11.29.1201/ggkkeh
Source: chrome.exe, 00000003.00000002.3749637074.00002B3802BD0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.gstatic.com/generate_204
Source: chrome.exe, 00000003.00000002.3752644525.00002B3802DB8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chrome.exe, 00000003.00000002.3733590482.00002B380240C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://accountcapabilities-pa.googleapis.com/
Source: chrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3737046211.00002B38025A0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com
Source: chrome.exe, 00000003.00000002.3730818086.00002B380220C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/
Source: chrome.exe, 00000003.00000002.3733313053.00002B38023C4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/AddSession
Source: chrome.exe, 00000003.00000002.3733590482.00002B380240C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/GetCheckConnectionInfo
Source: chrome.exe, 00000003.00000002.3733590482.00002B380240C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/ListAccounts?json=standard
Source: chrome.exe, 00000003.00000002.3733313053.00002B38023C4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/Logout
Source: chrome.exe, 00000003.00000002.3733313053.00002B38023C4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/Logoutw
Source: chrome.exe, 00000003.00000002.3733313053.00002B38023C4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/MergeSession
Source: chrome.exe, 00000003.00000002.3733313053.00002B38023C4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/OAuthLogin
Source: chrome.exe, 00000003.00000002.3733590482.00002B380240C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/RotateBoundCookies
Source: chrome.exe, 00000003.00000002.3733590482.00002B380240C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/chrome/blank.html
Source: chrome.exe, 00000003.00000002.3733590482.00002B380240C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/chrome/blank.htmlB
Source: chrome.exe, 00000003.00000002.3733590482.00002B380240C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/embedded/reauth/chromeos
Source: chrome.exe, 00000003.00000002.3731546524.00002B38022A8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/embedded/setup/chrome/usermenu
Source: chrome.exe, 00000003.00000002.3731546524.00002B38022A8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/embedded/setup/kidsignin/chromeos
Source: chrome.exe, 00000003.00000002.3731546524.00002B38022A8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/embedded/setup/kidsignup/chromeos
Source: chrome.exe, 00000003.00000002.3733590482.00002B380240C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/embedded/setup/v2/chromeos
Source: chrome.exe, 00000003.00000002.3733590482.00002B380240C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/embedded/setup/windows
Source: chrome.exe, 00000003.00000002.3733590482.00002B380240C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/embedded/xreauth/chrome
Source: chrome.exe, 00000003.00000002.3733590482.00002B380240C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/encryption/unlock/desktop
Source: chrome.exe, 00000003.00000002.3733590482.00002B380240C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/o/oauth2/revoke
Source: chrome.exe, 00000003.00000002.3733590482.00002B380240C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/oauth/multilogin
Source: chrome.exe, 00000003.00000002.3733590482.00002B380240C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/signin/chrome/sync?ssp=1
Source: chrome.exe, 00000003.00000002.3733313053.00002B38023C4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com:443
Source: chrome.exe, 00000003.00000002.3751045251.00002B3802C60000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://alling.p
Source: chrome.exe, 00000003.00000002.3608907333.000001A4CFEED000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://analytics.google.com/g/collect?v=2&tid=G-VFQWFX3X1C&gtm=45je4au0v898645365za200zb9103256652&
Source: chrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/4830
Source: chrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/4966
Source: chrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/5845
Source: chrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/6574
Source: chrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/7161
Source: chrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/7162
Source: chrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/7162P
Source: chrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/7246
Source: chrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/7246d
Source: chrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/7308
Source: chrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/7319
Source: chrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/7320
Source: chrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3746131922.00002B38029D8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/7369
Source: chrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/7369L
Source: chrome.exe, 00000003.00000002.3751750048.00002B3802D38000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/7382
Source: chrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/7489
Source: chrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/7489f
Source: chrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/7604
Source: chrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/7714
Source: chrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/7847
Source: chrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/7847_
Source: chrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/7899
Source: chrome.exe, 00000003.00000002.3745519336.00002B3802918000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://calendar.google.com/calendar/u/0/r/eventedit?usp=chrome_actions
Source: chrome.exe, 00000003.00000002.3752644525.00002B3802DB8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.ico
Source: chrome.exe, 00000003.00000002.3740462967.00002B380280C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/search?ei=&fr=crmas&p=
Source: chrome.exe, 00000003.00000002.3740462967.00002B380280C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/search?ei=&fr=crmas&p=searchTerms
Source: chrome.exe, 00000003.00000002.3749452474.00002B3802BA0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chrome.exe, 00000003.00000002.3730818086.00002B380220C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3739647333.00002B3802784000.00000004.00000001.00020000.00000000.sdmp, PcAppStore.exe, 0000000B.00000003.3087326267.0000017814269000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000B.00000002.3465025057.00000178138E0000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000B.00000003.3087459061.000001781427B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://chrome.google.com/webstore
Source: chrome.exe, 00000003.00000002.3739647333.00002B3802784000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://chrome.google.com/webstore206E5
Source: chrome.exe, 00000003.00000002.3766459056.00002B3803B60000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3749637074.00002B3802BD0000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3741627999.00002B3802880000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3749109113.00002B3802B7C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: chrome.exe, 00000003.00000002.3766459056.00002B3803B60000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://chrome.google.com/webstore?hl=en0
Source: chrome.exe, 00000003.00000002.3749637074.00002B3802BD0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://chrome.google.com/webstore?hl=enz
Source: chrome.exe, 00000003.00000002.3579352343.000001A4CF910000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://chromekanonymity-pa.googleapis.com/
Source: chrome.exe, 00000003.00000002.3579352343.000001A4CF910000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/
Source: chrome.exe, 00000003.00000002.3579352343.000001A4CF910000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/(
Source: chrome.exe, 00000003.00000002.3579352343.000001A4CF910000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/(TrustTokenOperationsRequiringOriginTrial#all-operat
Source: chrome.exe, 00000003.00000002.3733590482.00002B380240C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://chromereporting-pa.googleapis.com/v1/events
Source: chrome.exe, 00000003.00000002.3733590482.00002B380240C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://chromereporting-pa.googleapis.com/v1/record
Source: chrome.exe, 00000003.00000002.3730818086.00002B380220C000.00000004.00000001.00020000.00000000.sdmp, PcAppStore.exe, 0000000B.00000002.3465025057.000001781391A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://chromewebstore.google.com/
Source: chrome.exe, 00000003.00000002.3752021398.00002B3802D6C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://chromium-i18n.appspot.com/ssl-aggregate-address/
Source: chrome.exe, 00000003.00000002.3733313053.00002B38023C4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://classroom.googleapis.com/
Source: chrome.exe, 00000003.00000002.3733313053.00002B38023C4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://classroom.googleapis.com/gw
Source: chrome.exe, 00000003.00000002.3742644524.00002B38028F9000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3730818086.00002B380220C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3733313053.00002B38023C4000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3745395695.00002B3802904000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3752441724.00002B3802DA4000.00000004.00000001.00020000.00000000.sdmp, PcAppStore.exe, 0000000B.00000002.3465025057.00000178138E0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://clients2.google.com/service/update2/crx
Source: chrome.exe, 00000003.00000002.3733313053.00002B38023C4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://clients4.google.com/chrome-sync
Source: chrome.exe, 00000003.00000002.3733313053.00002B38023C4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://clients4.google.com/chrome-sync/event
Source: chrome.exe, 00000003.00000002.3738336166.00002B3802698000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=117
Source: chrome.exe, 00000003.00000002.3734936744.00002B38024F0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://csp.withgoogle.c
Source: chrome.exe, 00000003.00000002.3737391426.00002B3802622000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3769723558.00002B3803E38000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3760360864.00002B38033B8000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3766891817.00002B3803C38000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3764753920.00002B3803AB4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://csp.withgoogle.com/csp/analytics-container-tag-serving
Source: chrome.exe, 00000003.00000002.3769023040.00002B3803DC8000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3766891817.00002B3803C38000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://csp.withgoogle.com/csp/analytics-container-tag-serving6
Source: chrome.exe, 00000003.00000002.3750848896.00002B3802C3C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://csp.withgoogle.com/csp/analytics-container-tag-servingCross-Origin-Resource-Policy:
Source: chrome.exe, 00000003.00000002.3587946605.000001A4CFD3D000.00000004.00000001.00040000.00000000.sdmp, chrome.exe, 00000003.00000002.3760360864.00002B38033B8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://csp.withgoogle.com/csp/clientupdate-aus/1
Source: chrome.exe, 00000003.00000002.3755493361.00002B38030B4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://csp.withgoogle.com/csp/clientupdate-aus/1Cache-Control:
Source: chrome.exe, 00000003.00000002.3587946605.000001A4CFD3D000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://csp.withgoogle.com/csp/clientupdate-aus/1d
Source: chrome.exe, 00000003.00000002.3746575735.00002B3802A38000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://csp.withgoogle.com/csp/clientupdate-aus/1g
Source: chrome.exe, 00000003.00000002.3734936744.00002B38024F0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://csp.withgoogle.com/csp/download-dt/1
Source: chrome.exe, 00000003.00000002.3746575735.00002B3802A38000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://csp.withgoogle.com/csp/download-dt/1B
Source: chrome.exe, 00000003.00000002.3747890701.00002B3802B00000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3734936744.00002B38024F0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://csp.withgoogle.com/csp/download-dt/1Content-Security-Policy:
Source: chrome.exe, 00000003.00000002.3747890701.00002B3802B00000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3734936744.00002B38024F0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://csp.withgoogle.com/csp/download-dt/1Content-Type:
Source: chrome.exe, 00000003.00000002.3747890701.00002B3802B00000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://csp.withgoogle.com/csp/download-dt/1d
Source: chrome.exe, 00000003.00000002.3746575735.00002B3802A38000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://csp.withgoogle.com/csp/download-dt/1msi
Source: chrome.exe, 00000003.00000002.3750848896.00002B3802C3C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://csp.withgoogle.com/csp/report-to/analytics-container-tag-serving
Source: chrome.exe, 00000003.00000002.3629747706.000001A4D047D000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0
Source: chrome.exe, 00000003.00000002.3587946605.000001A4CFD3D000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
Source: chrome.exe, 00000003.00000002.3629747706.000001A4D047D000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0Cross-Origin-Opener-Policy-Report-Only:
Source: chrome.exe, 00000003.00000002.3608907333.000001A4CFEED000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:136:0
Source: Setup.exe, 00000000.00000003.2411255990.0000000002AD2000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000002.2418268746.0000000002AD2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://delivery.pcapp.store/
Source: Setup.exe, 00000000.00000003.2411255990.0000000002AD2000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000002.2418268746.0000000002AD2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://delivery.pcapp.store/.
Source: Setup.exe, 00000000.00000003.2412639264.0000000002B05000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://delivery.pcapp.store/download.php?&src=mini_installer&file=1&mini_
Source: Setup.exe, 00000000.00000002.2417315068.00000000006DA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://delivery.pcapp.store/download.php?&src=mini_installer&file=1&mini_ver=&evt_src=fa_mini_insta
Source: Setup.exe, 00000000.00000002.2413568462.0000000000436000.00000004.00000001.01000000.00000003.sdmpString found in binary or memory: https://delivery.pcapp.store/download.php?&src=mini_installer&file=1&mini_ver=ersion=fa.1092c&src=pc
Source: Setup.exe, 00000000.00000003.2412724071.0000000002AD8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://delivery.pcapp.store/download.php?&src=mini_installer&file=1&mini_ver=fa.1092c
Source: chrome.exe, 00000003.00000002.3732007335.00002B38022F0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://dl.google.com/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjhkYWYwZDctOTExOS00MGQ5LTgyNjA
Source: chrome.exe, 00000003.00000002.3756198806.00002B3803124000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://dl.google.com/release2/chrome_component/V3P1l2hLvLw_7/7_all_sslErrorAssistant.crx3
Source: chrome.exe, 00000003.00000002.3756198806.00002B3803124000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://dl.google.com/release2/chrome_component/V3P1l2hLvLw_7/7_all_sslErrorAssistant.crx375/
Source: chrome.exe, 00000003.00000002.3749950020.00002B3802C0C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://dl.google.com/release2/chrome_component/ac6mhlwypzipnufijdvfyhdgvt4q_67/khaoiebndkojlmppeemj
Source: chrome.exe, 00000003.00000002.3749028177.00002B3802B60000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://dl.google.com/release2/chrome_component/acaldksiunzh56452py2db5mnbpa_120.0.6050.0/jamhcnnkih
Source: chrome.exe, 00000003.00000002.3749028177.00002B3802B60000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://dl.google.com/release2/chrome_component/acccxbt6wwsvpxzpob4hojndwkqq_4.10.2830.0/oimompecagn
Source: chrome.exe, 00000003.00000002.3732007335.00002B38022F0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://dl.google.com/release2/chrome_component/ad3skwo2srs5xchyxzz6ujgnedha_9.52.0/gcmjkmgdlgnkkcoc
Source: chrome.exe, 00000003.00000002.3767123957.00002B3803C6C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://dl.google.com/release2/chrome_component/adrga7eefaxjfdmmgfkiaxjg4yjq_2024.7.12.235938/eeigpn
Source: chrome.exe, 00000003.00000002.3746575735.00002B3802A38000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://dl.google.com/release2/chrome_component/b3n6bzc5iojg34kogsjitu53ou_20241024.690425616.14/obe
Source: chrome.exe, 00000003.00000002.3749028177.00002B3802B60000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://dl.google.com/release2/chrome_component/cpx7rw4q3nwu7emczqf2w6cu7y_2023.3.30.1305/cocncanlea
Source: chrome.exe, 00000003.00000002.3732007335.00002B38022F0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://dl.google.com/release2/chrome_component/cxxqn654fg7hzrcrrnqcniqqye_2024.10.11.1/kiabhabjdbkj
Source: chrome.exe, 00000003.00000002.3749028177.00002B3802B60000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3732007335.00002B38022F0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://dl.google.com/release2/chrome_component/e6xlmsu5i2bokri3w4cyuhv4nq_2024.8.10.0/gonpemdgkjcec
Source: chrome.exe, 00000003.00000002.3732007335.00002B38022F0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://dl.google.com/release2/chrome_component/imoffpf67hel7kbknqflao2oo4_1.0.2738.0/neifaoindggfcj
Source: chrome.exe, 00000003.00000002.3767123957.00002B3803C6C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://dl.google.com/release2/chrome_component/p2zbkxfgkqyr6ljey2oe3bnzoy_2023.11.29.1201/ggkkehgbn
Source: chrome.exe, 00000003.00000002.3740597670.00002B3802831000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3740959914.00002B3802854000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/document/:
Source: chrome.exe, 00000003.00000002.3740597670.00002B3802831000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3740959914.00002B3802854000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/document/?usp=installed_webapp
Source: chrome.exe, 00000003.00000002.3740597670.00002B3802831000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3740959914.00002B3802854000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/document/J
Source: chrome.exe, 00000003.00000002.3734777832.00002B38024C0000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3740597670.00002B3802831000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3740959914.00002B3802854000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/document/installwebapp?usp=chrome_default
Source: chrome.exe, 00000003.00000002.3745878341.00002B38029A0000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3745991408.00002B38029B4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/document/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000003.00000002.3745878341.00002B38029A0000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3745991408.00002B38029B4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/forms/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000003.00000002.3745878341.00002B38029A0000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3745991408.00002B38029B4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/forms/u/0/create?usp=chrome_actionsy
Source: chrome.exe, 00000003.00000002.3740597670.00002B3802831000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3740959914.00002B3802854000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/presentation/:
Source: chrome.exe, 00000003.00000002.3740597670.00002B3802831000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3740959914.00002B3802854000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/presentation/?usp=installed_webapp
Source: chrome.exe, 00000003.00000002.3740597670.00002B3802831000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3740959914.00002B3802854000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/presentation/J
Source: chrome.exe, 00000003.00000002.3734777832.00002B38024C0000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3740597670.00002B3802831000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3740959914.00002B3802854000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/presentation/installwebapp?usp=chrome_default
Source: chrome.exe, 00000003.00000002.3745519336.00002B3802918000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/presentation/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000003.00000002.3740597670.00002B3802831000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3740959914.00002B3802854000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/spreadsheets/:
Source: chrome.exe, 00000003.00000002.3740597670.00002B3802831000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3740959914.00002B3802854000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/spreadsheets/?usp=installed_webapp
Source: chrome.exe, 00000003.00000002.3740597670.00002B3802831000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3740959914.00002B3802854000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/spreadsheets/J
Source: chrome.exe, 00000003.00000002.3734777832.00002B38024C0000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3740597670.00002B3802831000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3740959914.00002B3802854000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/spreadsheets/installwebapp?usp=chrome_default
Source: chrome.exe, 00000003.00000002.3745519336.00002B3802918000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/spreadsheets/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000003.00000002.3761387406.00002B3803548000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3764377935.00002B3803A14000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3763529808.00002B38037A8000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3763448598.00002B380379C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3764896708.00002B3803ADC000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3762117398.00002B38035F0000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3761006763.00002B38034D4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://doubleclick.net/
Source: chrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://doubleclick.net/5
Source: chrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://doubleclick.net/R
Source: chrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://doubleclick.net/Y
Source: chrome.exe, 00000003.00000002.3761387406.00002B3803548000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3763448598.00002B380379C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3762117398.00002B38035F0000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3761006763.00002B38034D4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://doubleclick.net/ore/
Source: chrome.exe, 00000003.00000002.3764896708.00002B3803ADC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://doubleclick.net/rPolicy8u
Source: chrome.exe, 00000003.00000002.3764896708.00002B3803ADC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://doubleclick.net/rmorithmz
Source: chrome.exe, 00000003.00000002.3764377935.00002B3803A14000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3763529808.00002B38037A8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://doubleclick.net/t/
Source: chrome.exe, 00000003.00000002.3740597670.00002B3802831000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3740959914.00002B3802854000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://drive.google.com/:
Source: chrome.exe, 00000003.00000002.3740597670.00002B3802831000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3740959914.00002B3802854000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://drive.google.com/?lfhs=2
Source: chrome.exe, 00000003.00000002.3740597670.00002B3802831000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3740959914.00002B3802854000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://drive.google.com/J
Source: chrome.exe, 00000003.00000002.3740597670.00002B3802831000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3740959914.00002B3802854000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3736969380.00002B3802590000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://drive.google.com/drive/installwebapp?usp=chrome_default
Source: chrome.exe, 00000003.00000002.3733590482.00002B380240C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3752441724.00002B3802DA4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/?q=
Source: chrome.exe, 00000003.00000002.3733590482.00002B380240C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/?q=searchTerms
Source: chrome.exe, 00000003.00000002.3752644525.00002B3802DB8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/ac/?q=
Source: chrome.exe, 00000003.00000002.3749637074.00002B3802BD0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/AMpg5-cnrANo_2018.8.8.0/2018.8.8.0_win64
Source: chrome.exe, 00000003.00000002.3757268228.00002B380321C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/V3P1l2hLvLw_7/7_all_sslErrorAssistant.cr
Source: chrome.exe, 00000003.00000002.3749028177.00002B3802B60000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/ac6mhlwypzipnufijdvfyhdgvt4q_67/khaoiebn
Source: chrome.exe, 00000003.00000002.3767123957.00002B3803C6C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaldksiunzh56452py2db5mnbpa_120.0.6050.
Source: chrome.exe, 00000003.00000002.3755363084.00002B380308C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acccxbt6wwsvpxzpob4hojndwkqq_4.10.2830.0
Source: chrome.exe, 00000003.00000002.3732007335.00002B38022F0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/ad3skwo2srs5xchyxzz6ujgnedha_9.52.0/gcmj
Source: chrome.exe, 00000003.00000002.3749028177.00002B3802B60000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adb2qwdrzgsbze5reot2ljihgpqa_9275/hfnkpi
Source: chrome.exe, 00000003.00000002.3749028177.00002B3802B60000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adohe7tf6ytr4v66tjma7zsnb3wq_1123/efnioj
Source: chrome.exe, 00000003.00000002.3746575735.00002B3802A38000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adrga7eefaxjfdmmgfkiaxjg4yjq_2024.7.12.2
Source: chrome.exe, 00000003.00000002.3732378949.00002B380234C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/b3n6bzc5iojg34kogsjitu53ou_20241024.6904
Source: chrome.exe, 00000003.00000002.3767123957.00002B3803C6C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/cpx7rw4q3nwu7emczqf2w6cu7y_2023.3.30.130
Source: chrome.exe, 00000003.00000002.3767123957.00002B3803C6C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/cxxqn654fg7hzrcrrnqcniqqye_2024.10.11.1/
Source: chrome.exe, 00000003.00000002.3755363084.00002B380308C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3767123957.00002B3803C6C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/e6xlmsu5i2bokri3w4cyuhv4nq_2024.8.10.0/g
Source: chrome.exe, 00000003.00000002.3767123957.00002B3803C6C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/imoffpf67hel7kbknqflao2oo4_1.0.2738.0/ne
Source: chrome.exe, 00000003.00000002.3749028177.00002B3802B60000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/kuv6sxh4r3bgt6ctayzn6cl44e_3049/jflookgn
Source: chrome.exe, 00000003.00000002.3767123957.00002B3803C6C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/p2zbkxfgkqyr6ljey2oe3bnzoy_2023.11.29.12
Source: chrome.exe, 00000003.00000002.3731088638.00002B3802258000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://fonts.googleapis.com/css2?fa
Source: chrome.exe, 00000003.00000002.3731088638.00002B3802258000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://fonts.googleapis.com/css2?faly
Source: chrome.exe, 00000003.00000002.3752441724.00002B3802DA9000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://fonts.gstatic.com/
Source: chrome.exe, 00000003.00000002.3768326183.00002B3803D44000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://goog.com
Source: chrome.exe, 00000003.00000002.3579352343.000001A4CF910000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/
Source: chrome.exe, 00000003.00000002.3579352343.000001A4CF910000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/
Source: chrome.exe, 00000003.00000002.3733313053.00002B38023C4000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3731546524.00002B38022A8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://google.com/
Source: chrome.exe, 00000003.00000002.3733313053.00002B38023C4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://google.com/googleapis.com
Source: chrome.exe, 00000003.00000002.3756544674.00002B3803190000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml
Source: chrome.exe, 00000003.00000002.3767301043.00002B3803CA4000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3768398613.00002B3803D50000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://googleads.g.doubleclick.net/pagead/viewthroughconversion/858128210/?random=1730913903683&cv=
Source: chrome.exe, 00000003.00000002.3767301043.00002B3803CA4000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3748871032.00002B3802B40000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://googleads.g.doubleclick.net/pagead/viewthroughconversion/858128210/?random=1730913903715&cv=
Source: chrome.exe, 00000003.00000002.3768398613.00002B3803D50000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://googleads.g.doubleclick.net/pagead/viewthroughconversion/858128210/?random=1730913903761&cv=
Source: chrome.exe, 00000003.00000002.3764377935.00002B3803A14000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3763529808.00002B38037A8000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3762747933.00002B3803674000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3763039980.00002B38036C0000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3763283267.00002B3803778000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3762821645.00002B380367C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3745991408.00002B38029B4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://googletagmanager.com/
Source: chrome.exe, 00000003.00000002.3764377935.00002B3803A14000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://googletagmanager.com/=
Source: chrome.exe, 00000003.00000002.3762747933.00002B3803674000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://googletagmanager.com/cy
Source: chrome.exe, 00000003.00000002.3762747933.00002B3803674000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://googletagmanager.com/ithmz
Source: chrome.exe, 00000003.00000002.3762821645.00002B380367C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://googletagmanager.com/y
Source: chrome.exe, 00000003.00000002.3739647333.00002B3802784000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://googleusercontent.com/
Source: chrome.exe, 00000003.00000002.3757797204.00002B3803240000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/161903006
Source: chrome.exe, 00000003.00000002.3757797204.00002B3803240000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/166809097
Source: chrome.exe, 00000003.00000002.3757797204.00002B3803240000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/184850002
Source: chrome.exe, 00000003.00000002.3757797204.00002B3803240000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/187425444
Source: chrome.exe, 00000003.00000002.3757797204.00002B3803240000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/220069903
Source: chrome.exe, 00000003.00000002.3757797204.00002B3803240000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/229267970
Source: chrome.exe, 00000003.00000002.3757797204.00002B3803240000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/250706693
Source: chrome.exe, 00000003.00000002.3757797204.00002B3803240000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/253522366
Source: chrome.exe, 00000003.00000002.3757797204.00002B3803240000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/255411748
Source: chrome.exe, 00000003.00000002.3757797204.00002B3803240000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/258207403
Source: chrome.exe, 00000003.00000002.3757797204.00002B3803240000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/274859104
Source: chrome.exe, 00000003.00000002.3757797204.00002B3803240000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/284462263
Source: chrome.exe, 00000003.00000002.3745878341.00002B38029A0000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3745991408.00002B38029B4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTE
Source: chrome.exe, 00000003.00000002.3745878341.00002B38029A0000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3745991408.00002B38029B4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTEkly
Source: chrome.exe, 00000003.00000002.3579352343.000001A4CF910000.00000004.00000001.00040000.00000000.sdmp, chrome.exe, 00000003.00000002.3749637074.00002B3802BD0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://labs.google.com/search/experiment/2
Source: chrome.exe, 00000003.00000002.3579352343.000001A4CF910000.00000004.00000001.00040000.00000000.sdmp, chrome.exe, 00000003.00000002.3745991408.00002B38029B4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://labs.google.com/search/experiment/2/springboard
Source: chrome.exe, 00000003.00000002.3579352343.000001A4CF910000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://labs.google.com/search/experiment/2/springboard#exps-registration-success-page-urls
Source: chrome.exe, 00000003.00000002.3579352343.000001A4CF910000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://labs.google.com/search/experiment/2/springboardPi
Source: chrome.exe, 00000003.00000002.3579352343.000001A4CF910000.00000004.00000001.00040000.00000000.sdmp, chrome.exe, 00000003.00000002.3749637074.00002B3802BD0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://labs.google.com/search/experiments
Source: chrome.exe, 00000003.00000002.3579352343.000001A4CF910000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://lens.google.com/v3/upload
Source: chrome.exe, 00000003.00000002.3579352343.000001A4CF910000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://lens.google.com/v3/upload#companion-iph-blocklisted-page-urls
Source: chrome.exe, 00000003.00000002.3733590482.00002B380240C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://m.google.com/devicemanagement/data/api
Source: chrome.exe, 00000003.00000002.3740597670.00002B3802831000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3740959914.00002B3802854000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://mail.google.com/mail/:
Source: chrome.exe, 00000003.00000002.3740597670.00002B3802831000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3740959914.00002B3802854000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://mail.google.com/mail/?usp=installed_webapp
Source: chrome.exe, 00000003.00000002.3740597670.00002B3802831000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3740959914.00002B3802854000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://mail.google.com/mail/J
Source: chrome.exe, 00000003.00000002.3740597670.00002B3802831000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3740959914.00002B3802854000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3736969380.00002B3802590000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://mail.google.com/mail/installwebapp?usp=chrome_default
Source: chrome.exe, 00000003.00000002.3745519336.00002B3802918000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://myaccount.google.com/?utm_source=ga-chrome-actions&utm_medium=manageGA
Source: chrome.exe, 00000003.00000002.3746575735.00002B3802A38000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacy
Source: chrome.exe, 00000003.00000002.3746575735.00002B3802A38000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhone
Source: chrome.exe, 00000003.00000002.3746575735.00002B3802A38000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://myaccount.google.com/signinoptions/password?utm_source=ga-chrome-actions&utm_medium=changePW
Source: chrome.exe, 00000003.00000002.3733313053.00002B38023C4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://oauthaccountmanager.googleapis.com/
Source: chrome.exe, 00000003.00000002.3733590482.00002B380240C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://oauthaccountmanager.googleapis.com/v1/issuetoken
Source: chrome.exe, 00000003.00000002.3753729568.00002B3802E94000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1&target=OPTIMIZATION_TARGET_PAGE_TOPICS_
Source: chrome.exe, 00000003.00000002.3753729568.00002B3802E94000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1673999601&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 00000003.00000002.3753729568.00002B3802E94000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1678906374&target=OPTIMIZATION_TARGET_OMN
Source: chrome.exe, 00000003.00000002.3753729568.00002B3802E94000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1679317318&target=OPTIMIZATION_TARGET_LAN
Source: chrome.exe, 00000003.00000002.3753729568.00002B3802E94000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049402&target=OPTIMIZATION_TARGET_GEO
Source: chrome.exe, 00000003.00000002.3734777832.00002B38024C0000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3753729568.00002B3802E94000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049414&target=OPTIMIZATION_TARGET_NOT
Source: chrome.exe, 00000003.00000002.3753729568.00002B3802E94000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695051229&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 00000003.00000002.3753729568.00002B3802E94000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=210230727&target=OPTIMIZATION_TARGET_CLIE
Source: chrome.exe, 00000003.00000002.3770180784.00002B3803E88000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3600689463.000001A4CFEB7000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://pagead2.googlesyndication.com/pagead/gen_204/?id=turtlex_join_ig&tx_jig=$
Source: chrome.exe, 00000003.00000002.3738971532.00002B3802740000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3742556996.00002B38028E4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.st
Source: chrome.exe, 00000003.00000002.3755862205.00002B3803101000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3741820899.00002B38028BE000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3771547025.00002B38043C8000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3768474243.00002B3803D70000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3746575735.00002B3802A38000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3741820899.00002B38028C0000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3737046211.00002B38025A0000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3608907333.000001A4CFEE7000.00000004.00000001.00040000.00000000.sdmp, chrome.exe, 00000003.00000002.3759083995.00002B38032DA000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store
Source: chrome.exe, 00000003.00000002.3768398613.00002B3803D50000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3741820899.00002B38028B6000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3765495968.00002B3803B40000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3757797204.00002B3803240000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3731088638.00002B3802258000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3741820899.00002B38028C0000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3759803058.00002B3803314000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3608907333.000001A4CFEE7000.00000004.00000001.00040000.00000000.sdmp, chrome.exe, 00000003.00000002.3731164079.00002B3802264000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3752794412.00002B3802DD8000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3751670065.00002B3802D2C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3759083995.00002B38032DA000.00000004.00000001.00020000.00000000.sdmp, nswC086.tmp, 00000009.00000003.2752597468.000000000065A000.00000004.00000020.00020000.00000000.sdmp, nswC086.tmp, 00000009.00000003.2909140998.000000000065A000.00000004.00000020.00020000.00000000.sdmp, nswC086.tmp, 00000009.00000002.2918019684.0000000003858000.00000004.00000020.00020000.00000000.sdmp, nswC086.tmp, 00000009.00000002.2910972081.000000000065A000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000B.00000002.3510546907.0000017814268000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/
Source: chrome.exe, 00000003.00000002.3638919968.000001A4D2113000.00000002.00000001.00040000.0000001D.sdmp, chrome.exe, 00000003.00000002.3760434344.00002B38033CE000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store//
Source: chrome.exe, 00000003.00000002.3749950020.00002B3802C0C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/11513052455
Source: Setup.exe, 00000000.00000003.2411255990.0000000002AD2000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000002.2418375456.0000000002AD9000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2412724071.0000000002AD8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/7
Source: chrome.exe, 00000003.00000002.3767123957.00002B3803C6C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/?p=lpd_installing_r2&guid=4D802742-3099-9C0E-C19B-2A23EA1FC420&_fcid
Source: chrome.exe, 00000003.00000002.3767123957.00002B3803C6C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/?p=lpd_installing_r2&guid=4D802742-3099-9C0E-C19B-2A23EA1FC420&_fcid5&_winve
Source: chrome.exe, 00000003.00000002.3741627999.00002B3802880000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3746900734.00002B3802A64000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3731923864.00002B38022E0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/?p=lpd_installing_r2&guid=4D802742-3099-9C0E-C19B-2A23EA1FC420&_fcid=17309115130
Source: Setup.exe, 00000000.00000003.2412078675.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2139676219.00000000007B4000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000002.2417415207.00000000007B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/I
Source: chrome.exe, 00000003.00000002.3769647200.00002B3803E2C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/P
Source: Setup.exe, 00000000.00000003.2411255990.0000000002AD2000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000002.2418375456.0000000002AD9000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2412724071.0000000002AD8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/a
Source: chrome.exe, 00000003.00000002.3740462967.00002B380280C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3745991408.00002B38029B4000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3752794412.00002B3802DD8000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3746131922.00002B38029D8000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3766891817.00002B3803C38000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/api/api.php
Source: chrome.exe, 00000003.00000002.3748871032.00002B3802B40000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/event%3Dconversion&rfmt=3&fmt=4
Source: chrome.exe, 00000003.00000002.3756198806.00002B3803124000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/images/front_img/lp/lpd_installing_r2/img/done_cursor_icon.svg
Source: Setup.exe, 00000000.00000003.2150334706.0000000002A87000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2150087517.0000000002A87000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2179097055.0000000002A87000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/inst_cpg.php?guid=4D802742-3099-9C0E-C19B-2A23EA1FC420&_fcid=173091151305245
Source: Setup.exe, 00000000.00000002.2417415207.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2139582406.0000000002A87000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/inst_cpg.php?guid=4D802742-3099-9C0E-C19B-2A23EA1FC420&_fcid=1730911513052455&ve
Source: Setup.exe, 00000000.00000002.2417315068.00000000006DA000.00000004.00000020.00020000.00000000.sdmp, nswC086.tmp, 00000009.00000002.2910700501.00000000005FB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/installing.php?guid=&winver=
Source: chrome.exe, 00000003.00000002.3741627999.00002B3802880000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3759083995.00002B38032DA000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3548504173.000001A4CBF30000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/installing.php?guid=4D802742-3099-9C0E-C19B-2A23EA1FC420&winver=19045&version=fa
Source: chrome.exe, 00000003.00000002.3629747706.000001A4D0477000.00000004.00000001.00040000.00000000.sdmp, chrome.exe, 00000003.00000002.3761158627.00002B3803504000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3761006763.00002B38034D4000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3764753920.00002B3803AB4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/lp/appstore/img/favicon.ico
Source: chrome.exe, 00000003.00000002.3761626357.00002B3803594000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/lp/appstore/img/favicon.ico0
Source: chrome.exe, 00000003.00000002.3763998455.00002B3803818000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/lp/appstore/img/favicon.icoA
Source: chrome.exe, 00000003.00000002.3762577074.00002B3803664000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/lp/appstore/img/favicon.icov
Source: chrome.exe, 00000003.00000002.3749637074.00002B3802BD0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/p=lpd_installing_r2&guid=4D802742-3099-9C0E-C19B-2A23EA1FC420&_fcid=173091151305
Source: Setup.exe, 00000000.00000003.2412639264.0000000002B05000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/pi
Source: Setup.exe, 00000000.00000002.2417415207.0000000000764000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exeString found in binary or memory: https://pcapp.store/pixel.gif?guid=
Source: Setup.exe, 00000000.00000003.2411255990.0000000002AC9000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000002.2417315068.000000000073D000.00000004.00000020.00020000.00000000.sdmp, nswC086.tmp, 00000009.00000003.2752597468.000000000065A000.00000004.00000020.00020000.00000000.sdmp, nswC086.tmp, 00000009.00000003.2762283464.0000000003880000.00000004.00000020.00020000.00000000.sdmp, nswC086.tmp, 00000009.00000003.2909140998.000000000065A000.00000004.00000020.00020000.00000000.sdmp, nswC086.tmp, 00000009.00000002.2910700501.000000000060E000.00000004.00000020.00020000.00000000.sdmp, nswC086.tmp, 00000009.00000002.2910700501.00000000005B0000.00000004.00000020.00020000.00000000.sdmp, nswC086.tmp, 00000009.00000002.2910972081.000000000065A000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000B.00000002.3419764074.00000178113FD000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000B.00000002.3530749433.000001781430A000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000B.00000002.3510546907.000001781428F000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000B.00000002.3465025057.000001781391A000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000B.00000002.3530749433.00000178142FA000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000B.00000003.3152994158.00000178113FD000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000B.00000003.3088478867.00000178113FD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/pixel.gif?guid=4D802742-3099-9C0E-C19B-2A23EA1FC420&version=fa.1092c&evt_src=fa_
Source: chrome.exe, 00000003.00000002.3761783808.00002B38035B8000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3762969080.00002B38036A8000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3762274674.00002B380362C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3763998455.00002B3803818000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/pixelgif.php
Source: chrome.exe, 00000003.00000002.3761783808.00002B38035B8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/pixelgif.php.
Source: chrome.exe, 00000003.00000002.3763998455.00002B3803818000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/pixelgif.php420
Source: chrome.exe, 00000003.00000002.3762274674.00002B380362C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/pixelgif.phpma
Source: chrome.exe, 00000003.00000002.3761783808.00002B38035B8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/pixelgif.phpterSave
Source: Setup.exe, 00000000.00000002.2417315068.00000000006DA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/privacy.html?guid=welhttps://pcapp.store/pixel.gif?guid=&version=&evt_src=fa_min
Source: chrome.exe, 00000003.00000002.3748871032.00002B3802B40000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/t%3Dconversion&rfmt=3&fmt=4
Source: chrome.exe, 00000003.00000002.3755363084.00002B380308C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/tory
Source: Setup.exe, 00000000.00000002.2417315068.00000000006DA000.00000004.00000020.00020000.00000000.sdmp, nswC086.tmp, 00000009.00000002.2910700501.00000000005FB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/tos.html?guid=
Source: chrome.exe, 00000003.00000002.3755862205.00002B3803101000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store1
Source: chrome.exe, 00000003.00000002.3771547025.00002B38043C8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store1e.html?origin=https%3A%2F%2Fpcapp.store
Source: chrome.exe, 00000003.00000002.3767848053.00002B3803CF8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.storeAccess-Control-Allow-Credentials:
Source: chrome.exe, 00000003.00000002.3752180609.00002B3802D96000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store_default
Source: chrome.exe, 00000003.00000002.3755862205.00002B38030FD000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.storewww.googletagmanager.com_default
Source: chrome.exe, 00000003.00000002.3755862205.00002B38030FD000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.storewww.googletagmanager.com_default/
Source: chrome.exe, 00000003.00000002.3749637074.00002B3802BD0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://redirector.gvt1.com/edgedl/release2/chrome_component/AMpg5-cnrANo_2018.8.8.0/2018.8.8.0_win6
Source: chrome.exe, 00000003.00000002.3757268228.00002B380321C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://redirector.gvt1.com/edgedl/release2/chrome_component/V3P1l2hLvLw_7/7_all_sslErrorAssistant.c
Source: chrome.exe, 00000003.00000002.3754268747.00002B3802EFB000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3766891817.00002B3803C38000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://repository.pcapp.store/pcapp/images/front_img/lp/lpd_installing_r2/img/done_cursor_icon.svg
Source: chrome.exe, 00000003.00000002.3755862205.00002B3803101000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://repository.pcapp.store/pcapp/images/front_img/lp/lpd_installing_r2/img/done_windows_icon.svg
Source: chrome.exe, 00000003.00000002.3733313053.00002B38023C4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://securitydomain-pa.googleapis.com/v1/
Source: chrome.exe, 00000003.00000002.3745878341.00002B38029A0000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3745991408.00002B38029B4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://sites.google.com/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000003.00000002.3745878341.00002B38029A0000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3745991408.00002B38029B4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://sites.google.com/u/0/create?usp=chrome_actionsactions
Source: chrome.exe, 00000003.00000002.3749637074.00002B3802BD0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://t0.gstatic.com/faviconV2
Source: chrome.exe, 00000003.00000002.3749637074.00002B3802BD0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://t0.gstatic.com/faviconV2s.com/
Source: chrome.exe, 00000003.00000002.3733313053.00002B38023C4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://tasks.googleapis.com/
Source: chrome.exe, 00000003.00000002.3770733649.00002B380404C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://td.d
Source: chrome.exe, 00000003.00000002.3737581568.00002B380262F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://td.doubleclick.n
Source: chrome.exe, 00000003.00000002.3755610485.00002B38030C8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://td.doubleclick.net
Source: chrome.exe, 00000003.00000002.3739780957.00002B38027A0000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3756476578.00002B3803184000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3740462967.00002B380280C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3732294118.00002B3802334000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3765344060.00002B3803B30000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3762895606.00002B3803690000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://td.doubleclick.net/
Source: chrome.exe, 00000003.00000002.3755610485.00002B38030C8000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3756476578.00002B3803184000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3740462967.00002B380280C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3732294118.00002B3802334000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3765344060.00002B3803B30000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3762895606.00002B3803690000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://td.doubleclick.net/td/bjs
Source: chrome.exe, 00000003.00000002.3755610485.00002B38030C8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://td.doubleclick.net/td/bts
Source: chrome.exe, 00000003.00000002.3749350230.00002B3802B94000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3756476578.00002B3803184000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3759803058.00002B3803314000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3762895606.00002B3803690000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://td.doubleclick.net/td/ga/rul?tid=G-VFQWFX3X1C&gacid=2133348484.1730913904&gtm=45je4au0v89864
Source: chrome.exe, 00000003.00000002.3767301043.00002B3803CA4000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3765495968.00002B3803B40000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://td.doubleclick.net/td/rul/858128210?random=1730913903683&cv=11&fst=1730913903683&fmt=3&bg=ff
Source: chrome.exe, 00000003.00000002.3767301043.00002B3803CA4000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3765495968.00002B3803B40000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3608907333.000001A4CFEE7000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://td.doubleclick.net/td/rul/858128210?random=1730913903715&cv=11&fst=1730913903715&fmt=3&bg=ff
Source: chrome.exe, 00000003.00000002.3748871032.00002B3802B40000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3768398613.00002B3803D50000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3765495968.00002B3803B40000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://td.doubleclick.net/td/rul/858128210?random=1730913903761&cv=11&fst=1730913903761&fmt=3&bg=ff
Source: chrome.exe, 00000003.00000002.3755610485.00002B38030C8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://td.doubleclick.net/td/update?ig_name=4s1971258614.1730913904
Source: chrome.exe, 00000003.00000002.3753800477.00002B3802EA6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://td.doubleclick.net4s1971258614.1730913904
Source: chrome.exe, 00000003.00000002.3753800477.00002B3802EA6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://td.doubleclick.net4s1971258614.1730913904/
Source: chrome.exe, 00000003.00000002.3752745456.00002B3802DC8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://td.doubleclick.neter.comccoofpliimaahmaaome
Source: chrome.exe, 00000003.00000002.3766620489.00002B3803C0C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://td.doubleclick.nethttps://pcapp.store
Source: chrome.exe, 00000003.00000002.3766620489.00002B3803C0C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://td.doubleclick.nethttps://pcapp.store/
Source: chrome.exe, 00000003.00000002.3755610485.00002B38030C8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://tdsf.doubleclick.net/td/adfetch/gda?adg_id=156786411258
Source: chrome.exe, 00000003.00000002.3740462967.00002B380280C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3762895606.00002B3803690000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://tdsf.doubleclick.net/td/adfetch/gda?adg_id=156786411258&cr_id=681164326060&cv_id=1&format=$
Source: chrome.exe, 00000003.00000002.3740462967.00002B380280C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3765344060.00002B3803B30000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3762895606.00002B3803690000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://tdsf.doubleclick.net/td/adfetch/gda?adg_id=156786411258&cr_id=681210400247&cv_id=2&format=$
Source: chrome.exe, 00000003.00000002.3766620489.00002B3803C0C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://tdsf.doubleclick.net/td/adfetch/gda?adg_id=156786411258&cr_id=6822392
Source: chrome.exe, 00000003.00000002.3756476578.00002B3803184000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3732294118.00002B3802334000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3762895606.00002B3803690000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://tdsf.doubleclick.net/td/adfetch/gda?adg_id=156786411258&cr_id=682239234212&cv_id=0&format=$
Source: chrome.exe, 00000003.00000002.3770920960.00002B3804088000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3765344060.00002B3803B30000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3762895606.00002B3803690000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://tdsf.doubleclick.net/td/adfetch/gda?adg_id=163766597928&cr_id=688766820411&cv_id=0&format=$
Source: chrome.exe, 00000003.00000002.3770920960.00002B3804088000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3765344060.00002B3803B30000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3762895606.00002B3803690000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://tdsf.doubleclick.net/td/adfetch/gda?adg_id=163766597928&cr_id=688766820414&cv_id=0&format=$
Source: chrome.exe, 00000003.00000002.3770920960.00002B3804088000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3765344060.00002B3803B30000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3762895606.00002B3803690000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://tdsf.doubleclick.net/td/adfetch/gda?adg_id=163766597928&cr_id=688766820429&cv_id=0&format=$
Source: chrome.exe, 00000003.00000002.3770920960.00002B3804088000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3765344060.00002B3803B30000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3762895606.00002B3803690000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://tdsf.doubleclick.net/td/adfetch/gda?adg_id=163766597928&cr_id=688766820432&cv_id=0&format=$
Source: chrome.exe, 00000003.00000002.3770920960.00002B3804088000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3765344060.00002B3803B30000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3762895606.00002B3803690000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://tdsf.doubleclick.net/td/adfetch/gda?adg_id=163766597928&cr_id=688766820444&cv_id=0&format=$
Source: chrome.exe, 00000003.00000002.3766620489.00002B3803C0C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://tdsf.doubleclick.net/td/adfetch/gda?adg_id=163766597928&cr_id=688766820450&cv_i
Source: chrome.exe, 00000003.00000002.3770920960.00002B3804088000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3765344060.00002B3803B30000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3762895606.00002B3803690000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://tdsf.doubleclick.net/td/adfetch/gda?adg_id=163766597928&cr_id=688766820450&cv_id=0&format=$
Source: chrome.exe, 00000003.00000002.3770920960.00002B3804088000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3732294118.00002B3802334000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3765344060.00002B3803B30000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://tdsf.doubleclick.net/td/adfetch/gda?adg_id=163766597928&cr_id=688766820453&cv_id=0&format=$
Source: chrome.exe, 00000003.00000002.3770920960.00002B3804088000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3732294118.00002B3802334000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3765344060.00002B3803B30000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://tdsf.doubleclick.net/td/adfetch/gda?adg_id=163766597928&cr_id=688766820456&cv_id=0&format=$
Source: chrome.exe, 00000003.00000002.3770920960.00002B3804088000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3765344060.00002B3803B30000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://tdsf.doubleclick.net/td/adfetch/gda?adg_id=163766597928&cr_id=688795175019&cv_id=0&format=$
Source: chrome.exe, 00000003.00000002.3770920960.00002B3804088000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3765344060.00002B3803B30000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://tdsf.doubleclick.net/td/adfetch/gda?adg_id=163766597928&cr_id=688917203998&cv_id=0&format=$
Source: chrome.exe, 00000003.00000002.3767123957.00002B3803C6C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://update.googleapis.com/service/update2/json?cup2key=13:unFt0Il60-acW8xg8iQOMd3_TomqKAmPyz3Ss7
Source: chrome.exe, 00000003.00000002.3751750048.00002B3802D38000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.ecosia.org/newtab/
Source: chrome.exe, 00000003.00000002.3752644525.00002B3802DB8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.ecosia.org/search?q=
Source: chrome.exe, 00000003.00000002.3752644525.00002B3802DB8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.ecosia.org/search?q=&addon=opensearch
Source: chrome.exe, 00000003.00000002.3752644525.00002B3802DB8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.ecosia.org/search?q=&addon=opensearchn=opensearch
Source: chrome.exe, 00000003.00000002.3739780957.00002B38027A0000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3738506886.00002B38026EC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/
Source: chrome.exe, 00000003.00000002.3748871032.00002B3802B40000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3745991408.00002B38029B4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/chrome/tips/
Source: chrome.exe, 00000003.00000002.3748871032.00002B3802B40000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3745991408.00002B38029B4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/chrome/tips/gs
Source: chrome.exe, 00000003.00000002.3749028177.00002B3802B60000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/dl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjhkYWYwZDctOTExOS00MGQ5LTg
Source: chrome.exe, 00000003.00000002.3746575735.00002B3802A38000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/dl/release2/chrome_component/AMpg5-cnrANo_2018.8.8.0/2018.8.8.0_win64_win_thi
Source: chrome.exe, 00000003.00000002.3749452474.00002B3802BA0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/dl/release2/chrome_component/V3P1l2hLvLw_7/7_all_sslErrorAssistant.crx3
Source: chrome.exe, 00000003.00000002.3753614829.00002B3802E74000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/dl/release2/chrome_component/ac6mhlwypzipnufijdvfyhdgvt4q_67/khaoiebndkojlmpp
Source: chrome.exe, 00000003.00000002.3749028177.00002B3802B60000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/dl/release2/chrome_component/acaldksiunzh56452py2db5mnbpa_120.0.6050.0/jamhcn
Source: chrome.exe, 00000003.00000002.3749028177.00002B3802B60000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/dl/release2/chrome_component/acccxbt6wwsvpxzpob4hojndwkqq_4.10.2830.0/oimompe
Source: chrome.exe, 00000003.00000002.3749028177.00002B3802B60000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/dl/release2/chrome_component/ad3skwo2srs5xchyxzz6ujgnedha_9.52.0/gcmjkmgdlgnk
Source: chrome.exe, 00000003.00000002.3767123957.00002B3803C6C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/dl/release2/chrome_component/adrga7eefaxjfdmmgfkiaxjg4yjq_2024.7.12.235938/ee
Source: chrome.exe, 00000003.00000002.3746575735.00002B3802A38000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/dl/release2/chrome_component/b3n6bzc5iojg34kogsjitu53ou_20241024.690425616.14
Source: chrome.exe, 00000003.00000002.3767123957.00002B3803C6C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/dl/release2/chrome_component/cpx7rw4q3nwu7emczqf2w6cu7y_2023.3.30.1305/cocnca
Source: chrome.exe, 00000003.00000002.3732007335.00002B38022F0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/dl/release2/chrome_component/cxxqn654fg7hzrcrrnqcniqqye_2024.10.11.1/kiabhabj
Source: chrome.exe, 00000003.00000002.3749028177.00002B3802B60000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3732007335.00002B38022F0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/dl/release2/chrome_component/e6xlmsu5i2bokri3w4cyuhv4nq_2024.8.10.0/gonpemdgk
Source: chrome.exe, 00000003.00000002.3732007335.00002B38022F0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/dl/release2/chrome_component/imoffpf67hel7kbknqflao2oo4_1.0.2738.0/neifaoindg
Source: chrome.exe, 00000003.00000002.3767123957.00002B3803C6C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/dl/release2/chrome_component/p2zbkxfgkqyr6ljey2oe3bnzoy_2023.11.29.1201/ggkke
Source: chrome.exe, 00000003.00000002.3745519336.00002B3802918000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3737892097.00002B3802648000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3740462967.00002B380280C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3751868131.00002B3802D4C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chrome.exe, 00000003.00000002.3759803058.00002B3803314000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/pagead/1p-user-list/858128210/?random=1730913903715&cv=11&fst=1730912400000&b
Source: chrome.exe, 00000003.00000002.3759803058.00002B3803314000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/pagead/1p-user-list/858128210/?random=1730913903761&cv=11&fst=1730912400000&b
Source: chrome.exe, 00000003.00000002.3587946605.000001A4CFD3D000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.googleadservices.com/pagead/p3p.xml
Source: chrome.exe, 00000003.00000002.3730818086.00002B380220C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.googleapis.com/
Source: chrome.exe, 00000003.00000002.3733590482.00002B380240C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.googleapis.com/oauth2/v1/userinfo
Source: chrome.exe, 00000003.00000002.3733590482.00002B380240C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.googleapis.com/oauth2/v2/tokeninfo
Source: chrome.exe, 00000003.00000002.3733590482.00002B380240C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.googleapis.com/oauth2/v4/token
Source: chrome.exe, 00000003.00000002.3733590482.00002B380240C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.googleapis.com/reauth/v1beta/users/
Source: chrome.exe, 00000003.00000002.3755862205.00002B38030FD000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3768474243.00002B3803D70000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3763283267.00002B3803778000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3761158627.00002B3803504000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.googletagmanager.com/
Source: chrome.exe, 00000003.00000002.3741373714.00002B3802860000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3752794412.00002B3802DD8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.googletagmanager.com/gtag/js?id=G-VFQWFX3X1C
Source: chrome.exe, 00000003.00000002.3742268235.00002B38028C4000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3608907333.000001A4CFEE7000.00000004.00000001.00040000.00000000.sdmp, chrome.exe, 00000003.00000002.3751670065.00002B3802D2C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.googletagmanager.com/gtag/js?id=G-VFQWFX3X1C&l=dataLayer&cx=c
Source: chrome.exe, 00000003.00000002.3769951455.00002B3803E58000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3746575735.00002B3802A38000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3767526443.00002B3803CC8000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3771472305.00002B38043B4000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3766891817.00002B3803C38000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3657757443.000001A4D22B7000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.googletagmanager.com/static/service_worker/4al0/sw.js?origin=https%3A%2F%2Fpcapp.store
Source: chrome.exe, 00000003.00000002.3771309598.00002B38043A8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.googletagmanager.com/static/service_worker/4al0/sw.js?origin=https%3A%2F%2Fpcapp.store0
Source: chrome.exe, 00000003.00000002.3742268235.00002B38028C4000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3766891817.00002B3803C38000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.googletagmanager.com/static/service_worker/4al0/sw.js?origin=https%3A%2F%2Fpcapp.storepp
Source: chrome.exe, 00000003.00000002.3768253441.00002B3803D38000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.googletagmanager.com/static/service_worker/4al0/sw.js?origin=https%3A%2F%2Fpcapp.storeto
Source: chrome.exe, 00000003.00000002.3765495968.00002B3803B40000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3759803058.00002B3803314000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3771472305.00002B38043B4000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3766891817.00002B3803C38000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3657757443.000001A4D22B7000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.googletagmanager.com/static/service_worker/4al0/sw_iframe.html?origin=https%3A%2F%2Fpcap
Source: chrome.exe, 00000003.00000002.3738336166.00002B3802698000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.gstatic.com/chrome/intelligence/assist/ranker/models/translate/2017/03/translate_ranker_
Source: chrome.exe, 00000003.00000002.3755999622.00002B3803109000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.jsdelivr.com/using-sri-with-dynamic-files
Source: chrome.exe, 00000003.00000002.3740597670.00002B3802831000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3740959914.00002B3802854000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/:
Source: chrome.exe, 00000003.00000002.3740597670.00002B3802831000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3740959914.00002B3802854000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/?feature=ytca
Source: chrome.exe, 00000003.00000002.3740597670.00002B3802831000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3740959914.00002B3802854000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/J
Source: chrome.exe, 00000003.00000002.3734777832.00002B38024C0000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3740597670.00002B3802831000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3740959914.00002B3802854000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.html
Source: C:\Users\user\Desktop\Setup.exeCode function: 0_2_004056DE GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,0_2_004056DE
Source: C:\Users\user\PCAppStore\PcAppStore.exeWindows user hook set: 0 mouse low level C:\Users\user\PCAppStore\PcAppStore.exeJump to behavior

System Summary

barindex
Malicious sample detected (through community Yara rule)
Source: Process Memory Space: explorer.exe PID: 4004, type: MEMORYSTRMatched rule: Semi-Auto-generated - file ironshell.php.txt Author: Neo23x0 Yara BRG + customization by Stefan -dfate- Molls
Source: C:\Users\user\Desktop\Setup.exeCode function: 0_2_0040352D EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,ExitProcess,CoUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,0_2_0040352D
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpCode function: 9_2_00403640 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,ExitProcess,CoUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,9_2_00403640
Source: C:\Users\user\Desktop\Setup.exeCode function: 0_2_0040755C0_2_0040755C
Source: C:\Users\user\Desktop\Setup.exeCode function: 0_2_00406D850_2_00406D85
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpCode function: 9_2_00406D5F9_2_00406D5F
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 11_2_00007FF72FBFA80011_2_00007FF72FBFA800
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 11_2_00007FF72FBFB6A411_2_00007FF72FBFB6A4
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 11_2_00007FF72FA495B011_2_00007FF72FA495B0
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 11_2_00007FF72FC1127411_2_00007FF72FC11274
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 11_2_00007FF72FBEB06811_2_00007FF72FBEB068
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 11_2_00007FF72FC0F00811_2_00007FF72FC0F008
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 11_2_00007FF72FA20F2011_2_00007FF72FA20F20
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 11_2_00007FF72FC00F4811_2_00007FF72FC00F48
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 11_2_00007FF72FBEAE6411_2_00007FF72FBEAE64
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 11_2_00007FF72FBDEE2411_2_00007FF72FBDEE24
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 11_2_00007FF72FBFEDA411_2_00007FF72FBFEDA4
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 11_2_00007FF72FBCCD9C11_2_00007FF72FBCCD9C
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 11_2_00007FF72FBEAC5811_2_00007FF72FBEAC58
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 11_2_00007FF72FC10BD811_2_00007FF72FC10BD8
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 11_2_00007FF72FC02B9411_2_00007FF72FC02B94
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 11_2_00007FF72FBEAA5411_2_00007FF72FBEAA54
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 11_2_00007FF72FBFC9C411_2_00007FF72FBFC9C4
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 11_2_00007FF72FBEC75C11_2_00007FF72FBEC75C
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 11_2_00007FF72FBEC3D811_2_00007FF72FBEC3D8
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 11_2_00007FF72FC000EC11_2_00007FF72FC000EC
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 11_2_00007FF72FC0805811_2_00007FF72FC08058
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 11_2_00007FF72FC07DDC11_2_00007FF72FC07DDC
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 11_2_00007FF72FBEDD8811_2_00007FF72FBEDD88
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 11_2_00007FF72FC01A5C11_2_00007FF72FC01A5C
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 11_2_00007FF72FBED98411_2_00007FF72FBED984
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 11_2_00007FF72FBFB98811_2_00007FF72FBFB988
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 11_2_00007FF72FBC76A811_2_00007FF72FBC76A8
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 11_2_00007FF72FBF556011_2_00007FF72FBF5560
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 11_2_00007FF72FBEB47811_2_00007FF72FBEB478
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 11_2_00007FF72FC013DC11_2_00007FF72FC013DC
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 11_2_00007FF72FBEB27411_2_00007FF72FBEB274
Source: C:\Users\user\PCAppStore\Watchdog.exeCode function: 12_2_00007FF70D31175412_2_00007FF70D311754
Source: C:\Users\user\PCAppStore\Watchdog.exeCode function: 12_2_00007FF70D318EDC12_2_00007FF70D318EDC
Source: C:\Users\user\PCAppStore\Watchdog.exeCode function: 12_2_00007FF70D30ED5012_2_00007FF70D30ED50
Source: C:\Users\user\PCAppStore\Watchdog.exeCode function: 12_2_00007FF70D31DDDC12_2_00007FF70D31DDDC
Source: C:\Users\user\PCAppStore\Watchdog.exeCode function: 12_2_00007FF70D32285C12_2_00007FF70D32285C
Source: C:\Users\user\PCAppStore\Watchdog.exeCode function: 12_2_00007FF70D3190E812_2_00007FF70D3190E8
Source: C:\Users\user\PCAppStore\Watchdog.exeCode function: 12_2_00007FF70D319F2012_2_00007FF70D319F20
Source: C:\Users\user\PCAppStore\Watchdog.exeCode function: 12_2_00007FF70D31C7C412_2_00007FF70D31C7C4
Source: C:\Users\user\PCAppStore\Watchdog.exeCode function: 12_2_00007FF70D326AB812_2_00007FF70D326AB8
Source: C:\Users\user\PCAppStore\Watchdog.exeCode function: 12_2_00007FF70D31D94812_2_00007FF70D31D948
Source: C:\Users\user\PCAppStore\Watchdog.exeCode function: 12_2_00007FF70D31E45C12_2_00007FF70D31E45C
Source: C:\Users\user\PCAppStore\Watchdog.exeCode function: 12_2_00007FF70D318CD012_2_00007FF70D318CD0
Source: C:\Users\user\PCAppStore\Watchdog.exeCode function: 12_2_00007FF70D32033012_2_00007FF70D320330
Source: C:\Users\user\PCAppStore\Watchdog.exeCode function: 12_2_00007FF70D3223C012_2_00007FF70D3223C0
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: String function: 00007FF72F9D11A0 appears 403 times
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: String function: 00007FF72F9D0F30 appears 102 times
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: String function: 00007FF72F9DFCC0 appears 57 times
Source: NW_store.exe.9.drStatic PE information: Number of sections : 13 > 10
Source: nw.dll.9.drStatic PE information: Number of sections : 15 > 10
Source: vk_swiftshader.dll.9.drStatic PE information: Number of sections : 11 > 10
Source: ffmpeg.dll.9.drStatic PE information: Number of sections : 11 > 10
Source: vulkan-1.dll.9.drStatic PE information: Number of sections : 11 > 10
Source: libEGL.dll.9.drStatic PE information: Number of sections : 12 > 10
Source: node.dll.9.drStatic PE information: Number of sections : 11 > 10
Source: nw_elf.dll.9.drStatic PE information: Number of sections : 14 > 10
Source: libGLESv2.dll.9.drStatic PE information: Number of sections : 12 > 10
Source: notification_helper.exe.9.drStatic PE information: Number of sections : 13 > 10
Source: Setup.exe, 00000000.00000002.2413568462.000000000040A000.00000004.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameinetc.dllF vs Setup.exe
Source: Setup.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: Process Memory Space: explorer.exe PID: 4004, type: MEMORYSTRMatched rule: ironshell_php author = Neo23x0 Yara BRG + customization by Stefan -dfate- Molls, description = Semi-Auto-generated - file ironshell.php.txt, hash = 8bfa2eeb8a3ff6afc619258e39fded56
Source: classification engineClassification label: mal57.spyw.evad.winEXE@34/288@0/30
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 11_2_00007FF72F9D8790 GetLastError,FormatMessageW,11_2_00007FF72F9D8790
Source: C:\Users\user\Desktop\Setup.exeCode function: 0_2_0040352D EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,ExitProcess,CoUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,0_2_0040352D
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpCode function: 9_2_00403640 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,ExitProcess,CoUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,9_2_00403640
Source: C:\Users\user\Desktop\Setup.exeCode function: 0_2_0040498A GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,0_2_0040498A
Source: C:\Users\user\PCAppStore\Watchdog.exeCode function: 12_2_00007FF70D30DBA0 CreateToolhelp32Snapshot,Process32FirstW,CloseHandle,Concurrency::details::WorkQueue::IsStructuredEmpty,CloseHandle,Process32NextW,CloseHandle,12_2_00007FF70D30DBA0
Source: C:\Users\user\Desktop\Setup.exeCode function: 0_2_004021AA CoCreateInstance,0_2_004021AA
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 11_2_00007FF72FA71860 FindResourceExW,LoadResource,LockResource,SizeofResource,GlobalAlloc,GlobalLock,GlobalUnlock,CreateStreamOnHGlobal,GetLastError,11_2_00007FF72FA71860
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpFile created: C:\Users\user\PCAppStoreJump to behavior
Source: C:\Users\user\Desktop\Setup.exeFile created: C:\Users\user\AppData\Local\Temp\nsw9A20.tmpJump to behavior
Source: Setup.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeFile read: C:\Users\desktop.iniJump to behavior
Source: C:\Users\user\Desktop\Setup.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: nswC086.tmp, 00000009.00000002.2911981644.0000000002B8D000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000B.00000000.2782858444.00007FF72FC72000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000024.00000002.2920978128.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000024.00000000.2913753017.00007FF72FC72000.00000008.00000001.01000000.00000016.sdmpBinary or memory string: SELECT sql FROM%d UNION ALL SELECT shell_add_schema(sql,mainNULL,name) AS sql, type, tbl_name, name, rowid, AS snum, AS sname FROM .sqlite_schema UNION ALL SELECT shell_module_schema(name), 'table', name, name, name, 9e+99, 'main' FROM pragma_module_list) WHERE %Qlower(printf('%s.%s',sname,tbl_name))lower(tbl_name) GLOB LIKE ESCAPE '\' AND name NOT LIKE 'sqlite_%%' AND sql IS NOT NULL ORDER BY snum, rowidSQL: %s;
Source: nswC086.tmp, 00000009.00000002.2911981644.0000000002B8D000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000B.00000000.2782858444.00007FF72FC72000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000024.00000002.2920978128.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000024.00000000.2913753017.00007FF72FC72000.00000008.00000001.01000000.00000016.sdmpBinary or memory string: INSERT INTO sqlite_schema(type,name,tbl_name,rootpage,sql)VALUES('table','%q','%q',0,'%q');%s
Source: nswC086.tmp, 00000009.00000002.2911981644.0000000002B8D000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000B.00000000.2782858444.00007FF72FC72000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000024.00000002.2920978128.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000024.00000000.2913753017.00007FF72FC72000.00000008.00000001.01000000.00000016.sdmpBinary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: nswC086.tmp, 00000009.00000002.2911981644.0000000002B8D000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000B.00000000.2782858444.00007FF72FC72000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000024.00000002.2920978128.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000024.00000000.2913753017.00007FF72FC72000.00000008.00000001.01000000.00000016.sdmpBinary or memory string: SELECT max(length(key)) FROM temp.sqlite_parameters;
Source: nswC086.tmp, 00000009.00000002.2911981644.0000000002B8D000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000B.00000000.2782858444.00007FF72FC72000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000024.00000002.2920978128.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000024.00000000.2913753017.00007FF72FC72000.00000008.00000001.01000000.00000016.sdmpBinary or memory string: CREATE TABLE ColNames( cpos INTEGER PRIMARY KEY, name TEXT, nlen INT, chop INT, reps INT, suff TEXT);CREATE VIEW RepeatedNames AS SELECT DISTINCT t.name FROM ColNames t WHERE t.name COLLATE NOCASE IN ( SELECT o.name FROM ColNames o WHERE o.cpos<>t.cpos);
Source: nswC086.tmp, 00000009.00000002.2911981644.0000000002B8D000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000B.00000000.2782858444.00007FF72FC72000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000024.00000002.2920978128.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000024.00000000.2913753017.00007FF72FC72000.00000008.00000001.01000000.00000016.sdmpBinary or memory string: SELECT type,name,tbl_name,sql FROM sqlite_schema ORDER BY name;
Source: nswC086.tmp, 00000009.00000002.2911981644.0000000002B8D000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000B.00000000.2782858444.00007FF72FC72000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000024.00000002.2920978128.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000024.00000000.2913753017.00007FF72FC72000.00000008.00000001.01000000.00000016.sdmpBinary or memory string: SELECT key, quote(value) FROM temp.sqlite_parameters;
Source: chrome.exe, 00000003.00000002.3740959914.00002B380285B000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: CREATE TABLE psl_extensions (domain VARCHAR NOT NULL, UNIQUE (domain));
Source: nswC086.tmp, 00000009.00000002.2911981644.0000000002B8D000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000B.00000000.2782858444.00007FF72FC72000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000024.00000002.2920978128.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000024.00000000.2913753017.00007FF72FC72000.00000008.00000001.01000000.00000016.sdmpBinary or memory string: SELECT 'CREATE TEMP' || substr(sql, 7) FROM sqlite_schema WHERE tbl_name = %Q AND type IN ('table', 'trigger') ORDER BY type;
Source: nswC086.tmp, 00000009.00000002.2911981644.0000000002B8D000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000B.00000000.2782858444.00007FF72FC72000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000024.00000002.2920978128.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000024.00000000.2913753017.00007FF72FC72000.00000008.00000001.01000000.00000016.sdmpBinary or memory string: INSERT INTO selftest(tno,op,cmd,ans) SELECT rowid*10,op,cmd,ans FROM [_shell$self];
Source: nswC086.tmp, 00000009.00000002.2911981644.0000000002B8D000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000B.00000000.2782858444.00007FF72FC72000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000024.00000002.2920978128.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000024.00000000.2913753017.00007FF72FC72000.00000008.00000001.01000000.00000016.sdmpBinary or memory string: SELECT * FROM "%w" ORDER BY rowid DESC;Warning: cannot step "%s" backwardsSELECT name, sql FROM sqlite_schema WHERE %sError: (%d) %s on [%s]
Source: nswC086.tmp, 00000009.00000002.2911981644.0000000002B8D000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000B.00000000.2782858444.00007FF72FC72000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000024.00000002.2920978128.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000024.00000000.2913753017.00007FF72FC72000.00000008.00000001.01000000.00000016.sdmpBinary or memory string: INSERT INTO sqlite_schema(type,name,tbl_name,rootpage,sql)VALUES('table','%q','%q',0,'%q');
Source: nswC086.tmp, 00000009.00000002.2911981644.0000000002B8D000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000B.00000000.2782858444.00007FF72FC72000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000024.00000002.2920978128.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000024.00000000.2913753017.00007FF72FC72000.00000008.00000001.01000000.00000016.sdmpBinary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: nswC086.tmp, 00000009.00000002.2911981644.0000000002B8D000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000B.00000000.2782858444.00007FF72FC72000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000024.00000002.2920978128.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000024.00000000.2913753017.00007FF72FC72000.00000008.00000001.01000000.00000016.sdmpBinary or memory string: SELECT * FROM "%w" ORDER BY rowid DESC;
Source: nswC086.tmp, 00000009.00000002.2911981644.0000000002B8D000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000B.00000000.2782858444.00007FF72FC72000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000024.00000002.2920978128.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000024.00000000.2913753017.00007FF72FC72000.00000008.00000001.01000000.00000016.sdmpBinary or memory string: SELECT tbl,idx,stat FROM sqlite_stat1 ORDER BY tbl,idx;
Source: nswC086.tmp, 00000009.00000002.2911981644.0000000002B8D000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000B.00000000.2782858444.00007FF72FC72000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000024.00000002.2920978128.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000024.00000000.2913753017.00007FF72FC72000.00000008.00000001.01000000.00000016.sdmpBinary or memory string: SELECT 'EXPLAIN QUERY PLAN SELECT 1 FROM ' || quote(s.name) || ' WHERE ' || group_concat(quote(s.name) || '.' || quote(f.[from]) || '=?' || fkey_collate_clause( f.[table], COALESCE(f.[to], p.[name]), s.name, f.[from]),' AND '), 'SEARCH ' || s.name || ' USING COVERING INDEX*(' || group_concat('*=?', ' AND ') || ')', s.name || '(' || group_concat(f.[from], ', ') || ')', f.[table] || '(' || group_concat(COALESCE(f.[to], p.[name])) || ')', 'CREATE INDEX ' || quote(s.name ||'_'|| group_concat(f.[from], '_')) || ' ON ' || quote(s.name) || '(' || group_concat(quote(f.[from]) || fkey_collate_clause( f.[table], COALESCE(f.[to], p.[name]), s.name, f.[from]), ', ') || ');', f.[table] FROM sqlite_schema AS s, pragma_foreign_key_list(s.name) AS f LEFT JOIN pragma_table_info AS p ON (pk-1=seq AND p.arg=f.[table]) GROUP BY s.name, f.id ORDER BY (CASE WHEN ? THEN f.[table] ELSE s.name END)
Source: nswC086.tmp, 00000009.00000002.2911981644.0000000002B8D000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000B.00000000.2782858444.00007FF72FC72000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000024.00000002.2920978128.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000024.00000000.2913753017.00007FF72FC72000.00000008.00000001.01000000.00000016.sdmpBinary or memory string: SELECT 'CREATE TEMP' || substr(sql, 7) FROM sqlite_schema WHERE tbl_name = %Q AND type IN ('table', 'trigger') ORDER BY type;ALTER TABLE temp.%Q RENAME TO %QINSERT INTO %Q VALUES(, %s?)UPDATE %Q SET , %s%Q=?DELETE FROM %QSELECT type, name, sql, 1 FROM sqlite_schema WHERE type IN ('table','view') AND name NOT LIKE 'sqlite_%%' UNION ALL SELECT type, name, sql, 2 FROM sqlite_schema WHERE type = 'trigger' AND tbl_name IN(SELECT name FROM sqlite_schema WHERE type = 'view') ORDER BY 4, 1CREATE TABLE x(, %s%Q COLLATE %s)CREATE VIRTUAL TABLE %Q USING expert(%Q)SELECT max(i.seqno) FROM sqlite_schema AS s, pragma_index_list(s.name) AS l, pragma_index_info(l.name) AS i WHERE s.type = 'table', %sx.%Q IS rem(%d, x.%Q) COLLATE %s%s%dSELECT %s FROM %Q x ORDER BY %sSELECT %s FROM temp.t592690916721053953805701627921227776 x ORDER BY %s%d %dDROP TABLE IF EXISTS temp.t592690916721053953805701627921227776CREATE TABLE temp.t592690916721053953805701627921227776 AS SELECT * FROM %QSELECT s.rowid, s.name, l.name FROM sqlite_schema AS s, pragma_index_list(s.name) AS l WHERE s.type = 'table'SELECT name, coll FROM pragma_index_xinfo(?) WHERE keyINSERT INTO sqlite_stat1 VALUES(?, ?, ?)ANALYZE; PRAGMA writable_schema=1remsampleDROP TABLE IF EXISTS temp.t592690916721053953805701627921227776ANALYZE sqlite_schemaDROP TABLE IF EXISTS temp.t592690916721053953805701627921227776:memory::memory:SELECT sql FROM sqlite_schema WHERE name NOT LIKE 'sqlite_%%' AND sql NOT LIKE 'CREATE VIRTUAL %%'Cannot find a unique index name to propose. -- stat1: %s;%s%s
Source: nswC086.tmp, 00000009.00000002.2911981644.0000000002B8D000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000B.00000000.2782858444.00007FF72FC72000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000024.00000002.2920978128.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000024.00000000.2913753017.00007FF72FC72000.00000008.00000001.01000000.00000016.sdmpBinary or memory string: INSERT OR IGNORE INTO "%s" VALUES(?,?);Error %d: %s on [%s]
Source: nswC086.tmp, 00000009.00000002.2911981644.0000000002B8D000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000B.00000000.2782858444.00007FF72FC72000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000024.00000002.2920978128.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000024.00000000.2913753017.00007FF72FC72000.00000008.00000001.01000000.00000016.sdmpBinary or memory string: SELECT name,seq FROM sqlite_sequence ORDER BY name;
Source: C:\Users\user\Desktop\Setup.exeFile read: C:\Users\user\Desktop\Setup.exeJump to behavior
Source: unknownProcess created: C:\Users\user\Desktop\Setup.exe "C:\Users\user\Desktop\Setup.exe"
Source: C:\Users\user\Desktop\Setup.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://pcapp.store/installing.php?guid=4D802742-3099-9C0E-C19B-2A23EA1FC420&winver=19045&version=fa.1092c&nocache=20241106122456.947&_fcid=1730911513052455
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1924 --field-trial-handle=2216,i,9566765671550453842,14323694336698430932,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5228 --field-trial-handle=2216,i,9566765671550453842,14323694336698430932,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5276 --field-trial-handle=2216,i,9566765671550453842,14323694336698430932,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\Desktop\Setup.exeProcess created: C:\Users\user\AppData\Local\Temp\nswC086.tmp "C:\Users\user\AppData\Local\Temp\nswC086.tmp" /internal 1730911513052455 /force
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpProcess created: C:\Users\user\PCAppStore\PcAppStore.exe "C:\Users\user\PCAppStore\PcAppStore.exe" /init default
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpProcess created: C:\Users\user\PCAppStore\Watchdog.exe "C:\Users\user\PCAppStore\Watchdog.exe" /guid=4D802742-3099-9C0E-C19B-2A23EA1FC420 /rid=20241106122556.806529687 /ver=fa.1092c
Source: C:\Windows\explorer.exeProcess created: C:\Users\user\PCAppStore\PcAppStore.exe "C:\Users\user\PCAppStore\PCAppStore.exe" /init default
Source: C:\Users\user\Desktop\Setup.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://pcapp.store/installing.php?guid=4D802742-3099-9C0E-C19B-2A23EA1FC420&winver=19045&version=fa.1092c&nocache=20241106122456.947&_fcid=1730911513052455Jump to behavior
Source: C:\Users\user\Desktop\Setup.exeProcess created: C:\Users\user\AppData\Local\Temp\nswC086.tmp "C:\Users\user\AppData\Local\Temp\nswC086.tmp" /internal 1730911513052455 /forceJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1924 --field-trial-handle=2216,i,9566765671550453842,14323694336698430932,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5228 --field-trial-handle=2216,i,9566765671550453842,14323694336698430932,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5276 --field-trial-handle=2216,i,9566765671550453842,14323694336698430932,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpProcess created: C:\Users\user\PCAppStore\PcAppStore.exe "C:\Users\user\PCAppStore\PcAppStore.exe" /init default Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpProcess created: C:\Users\user\PCAppStore\Watchdog.exe "C:\Users\user\PCAppStore\Watchdog.exe" /guid=4D802742-3099-9C0E-C19B-2A23EA1FC420 /rid=20241106122556.806529687 /ver=fa.1092cJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeProcess created: unknown unknownJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\explorer.exeProcess created: C:\Users\user\PCAppStore\PcAppStore.exe "C:\Users\user\PCAppStore\PCAppStore.exe" /init default
Source: C:\Windows\explorer.exeProcess created: unknown unknown
Source: C:\Windows\explorer.exeProcess created: unknown unknown
Source: C:\Windows\explorer.exeProcess created: unknown unknown
Source: C:\Users\user\Desktop\Setup.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: acgenral.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: winmm.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: samcli.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: msacm32.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: dwmapi.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: mpr.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: winmmbase.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: winmmbase.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: netutils.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: propsys.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: oleacc.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: shfolder.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: profapi.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: wbemcomn.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: amsi.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: wininet.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: secur32.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: winnsi.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: rasadhlp.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: fwpuclnt.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: schannel.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: mskeyprotect.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: ntasn1.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: dpapi.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: ncrypt.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: ncryptsslp.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: riched20.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: usp10.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: msls31.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: textinputframework.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: coreuicomponents.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: textshaping.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: windows.shell.servicehostbuilder.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: ieframe.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: netapi32.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: wkscli.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: windows.staterepositoryps.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: edputil.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: secur32.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: mlang.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: onecorecommonproxystub.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpSection loaded: propsys.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpSection loaded: dwmapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpSection loaded: cryptbase.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpSection loaded: oleacc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpSection loaded: ntmarta.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpSection loaded: version.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpSection loaded: shfolder.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpSection loaded: profapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpSection loaded: wbemcomn.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpSection loaded: amsi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpSection loaded: wininet.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpSection loaded: iertutil.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpSection loaded: winhttp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpSection loaded: mswsock.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpSection loaded: dpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpSection loaded: winnsi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpSection loaded: msasn1.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpSection loaded: cryptsp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpSection loaded: rsaenh.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpSection loaded: gpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpSection loaded: urlmon.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpSection loaded: srvcli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpSection loaded: netutils.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpSection loaded: dnsapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpSection loaded: rasadhlp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpSection loaded: fwpuclnt.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpSection loaded: schannel.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpSection loaded: mskeyprotect.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpSection loaded: ntasn1.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpSection loaded: ncrypt.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpSection loaded: ncryptsslp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpSection loaded: dhcpcsvc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpSection loaded: secur32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpSection loaded: linkinfo.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpSection loaded: ntshrui.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpSection loaded: cscapi.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: netutils.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: wlanapi.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: dwmapi.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: wtsapi32.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: secur32.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: profapi.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: wbemcomn.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: amsi.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: webio.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: winnsi.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: uiautomationcore.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: propsys.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: oleacc.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: coreuicomponents.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: uiamanager.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: rasadhlp.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: fwpuclnt.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: schannel.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: mskeyprotect.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: ntasn1.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: ncrypt.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: ncryptsslp.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: dpapi.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: sxs.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: wbemcomn.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: windowscodecs.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: textinputframework.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: winsta.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: windows.ui.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: windowmanagementapi.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: inputhost.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: twinapi.appcore.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: twinapi.appcore.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: twinapi.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: windows.shell.servicehostbuilder.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: edputil.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: windows.staterepositoryps.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: appresolver.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: bcp47langs.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: slc.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: sppc.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: onecorecommonproxystub.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: pcacli.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: mpr.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: sfc_os.dllJump to behavior
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: apphelp.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: urlmon.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: winhttp.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: iertutil.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: srvcli.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: netutils.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: windows.storage.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: wldp.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: kernel.appcore.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: uxtheme.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: wininet.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: sspicli.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: profapi.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: mswsock.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: iphlpapi.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: winnsi.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: dnsapi.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: rasadhlp.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: fwpuclnt.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: schannel.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: mskeyprotect.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: ntasn1.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: msasn1.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: dpapi.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: cryptsp.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: rsaenh.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: cryptbase.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: gpapi.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: ncrypt.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: ncryptsslp.dll
Source: C:\Windows\explorer.exeSection loaded: smartscreenps.dll
Source: C:\Windows\explorer.exeSection loaded: provsvc.dll
Source: C:\Windows\explorer.exeSection loaded: vcruntime140_1.dll
Source: C:\Windows\explorer.exeSection loaded: vcruntime140.dll
Source: C:\Windows\explorer.exeSection loaded: msvcp140.dll
Source: C:\Windows\explorer.exeSection loaded: vcruntime140.dll
Source: C:\Windows\explorer.exeSection loaded: capabilityaccessmanagerclient.dll
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeSection loaded: oleacc.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: urlmon.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: version.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: wlanapi.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: iphlpapi.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: winhttp.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: dwmapi.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: wtsapi32.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: secur32.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: profapi.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: sspicli.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: iertutil.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: srvcli.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: netutils.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: kernel.appcore.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: wbemcomn.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: amsi.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: userenv.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: ondemandconnroutehelper.dll
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeSection loaded: oleacc.dll
Source: C:\Users\user\Desktop\Setup.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32Jump to behavior
Source: PC App Store.lnk.9.drLNK file: ..\..\..\..\..\..\PCAppStore\PcAppStore.exe
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpRegistry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PCAppStoreJump to behavior
Source: Setup.exeStatic PE information: certificate valid
Source: Setup.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: C:\Build\Build_1092c_D20241025T171023\fa_rss\Watchdog\x64\Release\Watchdog.pdb source: nswC086.tmp, 00000009.00000002.2911981644.0000000002799000.00000004.00000020.00020000.00000000.sdmp, Watchdog.exe, 0000000C.00000002.3396323103.00007FF70D32A000.00000002.00000001.01000000.00000017.sdmp, Watchdog.exe, 0000000C.00000000.2783135227.00007FF70D32A000.00000002.00000001.01000000.00000017.sdmp
Source: Binary string: C:\Build\Build_1092c_D20241025T171023\fa_rss\AppStoreUpdater\Release\auto_updater.pdb1 source: nswC086.tmp, 00000009.00000002.2911981644.0000000002E84000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: MLLHdqUcwgfrtUaposkqsOihMsq.exe, 0000000F.00000002.3374146882.00000000005EE000.00000002.00000001.01000000.0000001A.sdmp, MLLHdqUcwgfrtUaposkqsOihMsq.exe, 00000011.00000000.2844362360.00000000005EE000.00000002.00000001.01000000.0000001A.sdmp, MLLHdqUcwgfrtUaposkqsOihMsq.exe, 00000012.00000002.3373624705.00000000005EE000.00000002.00000001.01000000.0000001A.sdmp, MLLHdqUcwgfrtUaposkqsOihMsq.exe, 00000013.00000000.2848958846.00000000005EE000.00000002.00000001.01000000.0000001A.sdmp, MLLHdqUcwgfrtUaposkqsOihMsq.exe, 00000014.00000002.3373622299.00000000005EE000.00000002.00000001.01000000.0000001A.sdmp, MLLHdqUcwgfrtUaposkqsOihMsq.exe, 00000015.00000002.3373639542.00000000005EE000.00000002.00000001.01000000.0000001A.sdmp, MLLHdqUcwgfrtUaposkqsOihMsq.exe, 00000016.00000002.3373641601.00000000005EE000.00000002.00000001.01000000.0000001A.sdmp, MLLHdqUcwgfrtUaposkqsOihMsq.exe, 00000017.00000000.2870418243.00000000005EE000.00000002.00000001.01000000.0000001A.sdmp, MLLHdqUcwgfrtUaposkqsOihMsq.exe, 00000018.00000002.3373635159.00000000005EE000.00000002.00000001.01000000.0000001A.sdmp, MLLHdqUcwgfrtUaposkqsOihMsq.exe, 00000019.00000000.2884084960.00000000005EE000.00000002.00000001.01000000.0000001A.sdmp, MLLHdqUcwgfrtUaposkqsOihMsq.exe, 0000001A.00000000.2885428722.00000000005EE000.00000002.00000001.01000000.0000001A.sdmp, MLLHdqUcwgfrtUaposkqsOihMsq.exe, 0000001B.00000000.2886851797.00000000005EE000.00000002.00000001.01000000.0000001A.sdmp, MLLHdqUcwgfrtUaposkqsOihMsq.exe, 0000001C.00000000.2888324770.00000000005EE000.00000002.00000001.01000000.0000001A.sdmp, MLLHdqUcwgfrtUaposkqsOihMsq.exe, 0000001D.00000000.2890285748.00000000005EE000.00000002.00000001.01000000.0000001A.sdmp, MLLHdqUcwgfrtUaposkqsOihMsq.exe, 0000001E.00000000.2892336343.00000000005EE000.00000002.00000001.01000000.0000001A.sdmp, MLLHdqUcwgfrtUaposkqsOihMsq.exe, 0000001F.00000002.3373644984.00000000005EE000.00000002.00000001.01000000.0000001A.sdmp, MLLHdqUcwgfrtUaposkqsOihMsq.exe, 00000020.00000000.2900995106.00000000005EE000.00000002.00000001.01000000.0000001A.sdmp, MLLHdqUcwgfrtUaposkqsOihMsq.exe, 00000021.00000002.3385667765.00000000005EE000.00000002.00000001.01000000.0000001A.sdmp, MLLHdqUcwgfrtUaposkqsOihMsq.exe, 00000022.00000000.2910127313.00000000005EE000.00000002.00000001.01000000.0000001A.sdmp, MLLHdqUcwgfrtUaposkqsOihMsq.exe, 00000023.00000002.3373628885.00000000005EE000.00000002.00000001.01000000.0000001A.sdmp, MLLHdqUcwgfrtUaposkqsOihMsq.exe, 00000025.00000002.3373632413.00000000005EE000.00000002.00000001.01000000.0000001A.sdmp, MLLHdqUcwgfrtUaposkqsOihMsq.exe, 00000026.00000002.3373625884.00000000005EE000.00000002.00000001.01000000.0000001A.sdmp, MLLHdqUcwgfrtUaposkqsOihMsq.exe, 00000027.00000000.2921015277.00000000005EE000.00000002.00000001.01000000.0000001A.sdmp, MLLHdqUcwgfrtUaposkqsOihMsq.exe, 00000028.00000000.2922273203.00000000005EE000.00000002.00000001.01000000.0000001A.sdmp, MLLHdqUcwg
Source: Binary string: C:\Users\zak\Downloads\Inetc\Unicode\Plugins\inetc.pdb source: Setup.exe, 00000000.00000002.2413568462.000000000040A000.00000004.00000001.01000000.00000003.sdmp
Source: Binary string: C:\Build\Build_1092c_D20241025T171023\fa_rss\user\Release\PCAppStore.pdb source: nswC086.tmp, 00000009.00000002.2911981644.0000000002B8D000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000000B.00000000.2782815097.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000024.00000000.2913689767.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000024.00000002.2920899777.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmp
Source: Binary string: C:\Build\Build_1092c_D20241025T171023\fa_rss\AppStoreUpdater\Release\auto_updater.pdb source: nswC086.tmp, 00000009.00000002.2911981644.0000000002E84000.00000004.00000020.00020000.00000000.sdmp
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 11_2_00007FF72FA2BFE0 atomic,RoGetActivationFactory,atomic,LoadLibraryW,GetProcAddress,RoGetActivationFactory,atomic,atomic,type_info::_name_internal_method,Concurrency::details::WorkQueue::IsStructuredEmpty,LoadLibraryW,Concurrency::details::_Scheduler::_Scheduler,GetProcAddress,atomic,11_2_00007FF72FA2BFE0
Source: Setup.exeStatic PE information: real checksum: 0x3937f should be: 0x33317
Source: NW_store.exe.9.drStatic PE information: real checksum: 0x0 should be: 0x23ab08
Source: System.dll.0.drStatic PE information: real checksum: 0x0 should be: 0x3d68
Source: System.dll.9.drStatic PE information: real checksum: 0x0 should be: 0x3d68
Source: vk_swiftshader.dll.9.drStatic PE information: real checksum: 0x0 should be: 0x44caa7
Source: ffmpeg.dll.9.drStatic PE information: real checksum: 0x0 should be: 0x1f8136
Source: nsJSON.dll.0.drStatic PE information: real checksum: 0x0 should be: 0x6718
Source: NSISFastLib.dll.0.drStatic PE information: real checksum: 0x0 should be: 0x30512
Source: inetc.dll.9.drStatic PE information: real checksum: 0x0 should be: 0x13c41
Source: vulkan-1.dll.9.drStatic PE information: real checksum: 0x0 should be: 0xe0b14
Source: libEGL.dll.9.drStatic PE information: real checksum: 0x0 should be: 0x7ddc6
Source: nsJSON.dll.9.drStatic PE information: real checksum: 0x0 should be: 0x6718
Source: Math.dll.9.drStatic PE information: real checksum: 0x0 should be: 0x155a8
Source: nw_elf.dll.9.drStatic PE information: real checksum: 0x0 should be: 0x124d11
Source: NSISFastLib.dll.9.drStatic PE information: real checksum: 0x0 should be: 0x30512
Source: inetc.dll.0.drStatic PE information: real checksum: 0x0 should be: 0x13c41
Source: libGLESv2.dll.9.drStatic PE information: real checksum: 0x0 should be: 0x7b9652
Source: notification_helper.exe.9.drStatic PE information: real checksum: 0x0 should be: 0x11edb8
Source: nsDialogs.dll.0.drStatic PE information: real checksum: 0x0 should be: 0x2f9b
Source: NW_store.exe.9.drStatic PE information: section name: .gxfg
Source: NW_store.exe.9.drStatic PE information: section name: .retplne
Source: NW_store.exe.9.drStatic PE information: section name: .voltbl
Source: NW_store.exe.9.drStatic PE information: section name: CPADinfo
Source: NW_store.exe.9.drStatic PE information: section name: _RDATA
Source: NW_store.exe.9.drStatic PE information: section name: malloc_h
Source: ffmpeg.dll.9.drStatic PE information: section name: .gxfg
Source: ffmpeg.dll.9.drStatic PE information: section name: .retplne
Source: ffmpeg.dll.9.drStatic PE information: section name: .voltbl
Source: ffmpeg.dll.9.drStatic PE information: section name: _RDATA
Source: libEGL.dll.9.drStatic PE information: section name: .gxfg
Source: libEGL.dll.9.drStatic PE information: section name: .retplne
Source: libEGL.dll.9.drStatic PE information: section name: .voltbl
Source: libEGL.dll.9.drStatic PE information: section name: _RDATA
Source: libEGL.dll.9.drStatic PE information: section name: malloc_h
Source: libGLESv2.dll.9.drStatic PE information: section name: .gxfg
Source: libGLESv2.dll.9.drStatic PE information: section name: .retplne
Source: libGLESv2.dll.9.drStatic PE information: section name: .voltbl
Source: libGLESv2.dll.9.drStatic PE information: section name: _RDATA
Source: libGLESv2.dll.9.drStatic PE information: section name: malloc_h
Source: node.dll.9.drStatic PE information: section name: .gxfg
Source: node.dll.9.drStatic PE information: section name: .retplne
Source: node.dll.9.drStatic PE information: section name: .voltbl
Source: node.dll.9.drStatic PE information: section name: _RDATA
Source: notification_helper.exe.9.drStatic PE information: section name: .gxfg
Source: notification_helper.exe.9.drStatic PE information: section name: .retplne
Source: notification_helper.exe.9.drStatic PE information: section name: .voltbl
Source: notification_helper.exe.9.drStatic PE information: section name: CPADinfo
Source: notification_helper.exe.9.drStatic PE information: section name: _RDATA
Source: notification_helper.exe.9.drStatic PE information: section name: malloc_h
Source: nw.dll.9.drStatic PE information: section name: .gxfg
Source: nw.dll.9.drStatic PE information: section name: .retplne
Source: nw.dll.9.drStatic PE information: section name: .rodata
Source: nw.dll.9.drStatic PE information: section name: .voltbl
Source: nw.dll.9.drStatic PE information: section name: CPADinfo
Source: nw.dll.9.drStatic PE information: section name: LZMADEC
Source: nw.dll.9.drStatic PE information: section name: _RDATA
Source: nw.dll.9.drStatic PE information: section name: malloc_h
Source: nw_elf.dll.9.drStatic PE information: section name: .crthunk
Source: nw_elf.dll.9.drStatic PE information: section name: .gxfg
Source: nw_elf.dll.9.drStatic PE information: section name: .retplne
Source: nw_elf.dll.9.drStatic PE information: section name: .voltbl
Source: nw_elf.dll.9.drStatic PE information: section name: CPADinfo
Source: nw_elf.dll.9.drStatic PE information: section name: _RDATA
Source: nw_elf.dll.9.drStatic PE information: section name: malloc_h
Source: vk_swiftshader.dll.9.drStatic PE information: section name: .gxfg
Source: vk_swiftshader.dll.9.drStatic PE information: section name: .retplne
Source: vk_swiftshader.dll.9.drStatic PE information: section name: .voltbl
Source: vk_swiftshader.dll.9.drStatic PE information: section name: _RDATA
Source: vulkan-1.dll.9.drStatic PE information: section name: .gxfg
Source: vulkan-1.dll.9.drStatic PE information: section name: .retplne
Source: vulkan-1.dll.9.drStatic PE information: section name: .voltbl
Source: vulkan-1.dll.9.drStatic PE information: section name: _RDATA
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 11_2_00007FF72FA2F0B0 pushfq ; ret 11_2_00007FF72FA2F0B1
Source: C:\Users\user\Desktop\Setup.exeFile created: C:\Users\user\AppData\Local\Temp\nsw9A21.tmp\System.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpFile created: C:\Users\user\PCAppStore\Watchdog.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpFile created: C:\Users\user\AppData\Local\Temp\nscF90.tmp\Math.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpFile created: C:\Users\user\PCAppStore\nwjs\libEGL.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpFile created: C:\Users\user\PCAppStore\nwjs\ffmpeg.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpFile created: C:\Users\user\AppData\Local\Temp\nscF90.tmp\NSISFastLib.dllJump to dropped file
Source: C:\Users\user\Desktop\Setup.exeFile created: C:\Users\user\AppData\Local\Temp\nswC086.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpFile created: C:\Users\user\PCAppStore\nwjs\node.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpFile created: C:\Users\user\PCAppStore\nwjs\vk_swiftshader.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpFile created: C:\Users\user\PCAppStore\nwjs\notification_helper.exeJump to dropped file
Source: C:\Users\user\Desktop\Setup.exeFile created: C:\Users\user\AppData\Local\Temp\nsw9A21.tmp\nsJSON.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpFile created: C:\Users\user\AppData\Local\Temp\nscF90.tmp\inetc.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpFile created: C:\Users\user\PCAppStore\nwjs\nw.dllJump to dropped file
Source: C:\Users\user\Desktop\Setup.exeFile created: C:\Users\user\AppData\Local\Temp\nsw9A21.tmp\NSISFastLib.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpFile created: C:\Users\user\PCAppStore\nwjs\vulkan-1.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpFile created: C:\Users\user\PCAppStore\Uninstaller.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpFile created: C:\Users\user\PCAppStore\nwjs\NW_store.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpFile created: C:\Users\user\PCAppStore\nwjs\nw_elf.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpFile created: C:\Users\user\PCAppStore\PcAppStore.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpFile created: C:\Users\user\PCAppStore\AutoUpdater.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpFile created: C:\Users\user\AppData\Local\Temp\nscF90.tmp\System.dllJump to dropped file
Source: C:\Users\user\Desktop\Setup.exeFile created: C:\Users\user\AppData\Local\Temp\nsw9A21.tmp\inetc.dllJump to dropped file
Source: C:\Users\user\PCAppStore\PcAppStore.exeFile created: C:\Users\user\PCAppStore\download\Setupuser.exeJump to dropped file
Source: C:\Users\user\Desktop\Setup.exeFile created: C:\Users\user\AppData\Local\Temp\nsw9A21.tmp\nsDialogs.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpFile created: C:\Users\user\PCAppStore\nwjs\libGLESv2.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpFile created: C:\Users\user\PCAppStore\nwjs\d3dcompiler_47.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpFile created: C:\Users\user\AppData\Local\Temp\nscF90.tmp\nsJSON.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpFile created: C:\Users\user\PCAppStore\ui\static\js\2.801b9d83.chunk.js.LICENSE.txtJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpFile created: C:\Users\user\PCAppStore\ReadMe.txtJump to behavior

Boot Survival

barindex
Creates multiple autostart registry keys
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run PcAppStoreUpdaterJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run WatchdogJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run PCAppStoreJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PC App Store.lnkJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run PCAppStoreJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run PCAppStoreJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run PcAppStoreUpdaterJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run PcAppStoreUpdaterJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run WatchdogJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run WatchdogJump to behavior
Source: C:\Users\user\Desktop\Setup.exeRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdateJump to behavior
Source: C:\Users\user\Desktop\Setup.exeRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRootJump to behavior
Source: C:\Users\user\Desktop\Setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\Setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\Setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\Setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\Setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\Setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\Setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\Setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\Setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\Setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\PCAppStore\PcAppStore.exeProcess information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

barindex
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Caption from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Size from Win32_DiskDrive
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Caption from Win32_DiskDrive
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Size from Win32_DiskDrive
Source: C:\Users\user\PCAppStore\Watchdog.exeThread delayed: delay time: 300000
Source: C:\Users\user\PCAppStore\PcAppStore.exeWindow / User API: threadDelayed 511Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeWindow / User API: threadDelayed 976Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeWindow / User API: threadDelayed 1657Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeWindow / User API: foregroundWindowGot 411Jump to behavior
Source: C:\Users\user\Desktop\Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsw9A21.tmp\System.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nscF90.tmp\Math.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpDropped PE file which has not been started: C:\Users\user\PCAppStore\nwjs\libEGL.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpDropped PE file which has not been started: C:\Users\user\PCAppStore\nwjs\ffmpeg.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nscF90.tmp\NSISFastLib.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpDropped PE file which has not been started: C:\Users\user\PCAppStore\nwjs\node.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpDropped PE file which has not been started: C:\Users\user\PCAppStore\nwjs\vk_swiftshader.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpDropped PE file which has not been started: C:\Users\user\PCAppStore\nwjs\notification_helper.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nscF90.tmp\inetc.dllJump to dropped file
Source: C:\Users\user\Desktop\Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsw9A21.tmp\nsJSON.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpDropped PE file which has not been started: C:\Users\user\PCAppStore\nwjs\nw.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpDropped PE file which has not been started: C:\Users\user\PCAppStore\nwjs\vulkan-1.dllJump to dropped file
Source: C:\Users\user\Desktop\Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsw9A21.tmp\NSISFastLib.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpDropped PE file which has not been started: C:\Users\user\PCAppStore\Uninstaller.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpDropped PE file which has not been started: C:\Users\user\PCAppStore\nwjs\NW_store.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpDropped PE file which has not been started: C:\Users\user\PCAppStore\nwjs\nw_elf.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpDropped PE file which has not been started: C:\Users\user\PCAppStore\AutoUpdater.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nscF90.tmp\System.dllJump to dropped file
Source: C:\Users\user\PCAppStore\PcAppStore.exeDropped PE file which has not been started: C:\Users\user\PCAppStore\download\Setupuser.exeJump to dropped file
Source: C:\Users\user\Desktop\Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsw9A21.tmp\inetc.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpDropped PE file which has not been started: C:\Users\user\PCAppStore\nwjs\libGLESv2.dllJump to dropped file
Source: C:\Users\user\Desktop\Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsw9A21.tmp\nsDialogs.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpDropped PE file which has not been started: C:\Users\user\PCAppStore\nwjs\d3dcompiler_47.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nscF90.tmp\nsJSON.dllJump to dropped file
Source: C:\Users\user\PCAppStore\Watchdog.exe TID: 7596Thread sleep count: 252 > 30
Source: C:\Users\user\PCAppStore\Watchdog.exe TID: 7596Thread sleep time: -15120000s >= -30000s
Source: C:\Users\user\PCAppStore\Watchdog.exe TID: 7720Thread sleep time: -300000s >= -30000s
Source: C:\Users\user\PCAppStore\Watchdog.exe TID: 7596Thread sleep time: -60000s >= -30000s
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select ReleaseDate from Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select ReleaseDate from Win32_BIOS
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select UUID from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Vendor from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Version from Win32_ComputerSystemProduct
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select UUID from Win32_ComputerSystemProduct
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Vendor from Win32_ComputerSystemProduct
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Version from Win32_ComputerSystemProduct
Source: C:\Users\user\PCAppStore\PcAppStore.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystemProduct
Source: C:\Users\user\PCAppStore\PcAppStore.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\PCAppStore\PcAppStore.exeLast function: Thread delayed
Source: C:\Users\user\PCAppStore\Watchdog.exeLast function: Thread delayed
Source: C:\Users\user\PCAppStore\Watchdog.exeLast function: Thread delayed
Source: C:\Users\user\Desktop\Setup.exeCode function: 0_2_00405C49 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,0_2_00405C49
Source: C:\Users\user\Desktop\Setup.exeCode function: 0_2_00406873 FindFirstFileW,FindClose,0_2_00406873
Source: C:\Users\user\Desktop\Setup.exeCode function: 0_2_0040290B FindFirstFileW,0_2_0040290B
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpCode function: 9_2_00405D74 CloseHandle,GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,9_2_00405D74
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpCode function: 9_2_0040699E FindFirstFileW,FindClose,9_2_0040699E
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpCode function: 9_2_0040290B FindFirstFileW,9_2_0040290B
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 11_2_00007FF72FBC75F8 FindClose,FindFirstFileExW,GetLastError,GetCurrentDirectoryW,GetLastError,11_2_00007FF72FBC75F8
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 11_2_00007FF72FBC76A8 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,__std_fs_open_handle,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,CloseHandle,CloseHandle,11_2_00007FF72FBC76A8
Source: C:\Users\user\PCAppStore\Watchdog.exeCode function: 12_2_00007FF70D3116E0 FindClose,FindFirstFileExW,GetLastError,12_2_00007FF70D3116E0
Source: C:\Users\user\PCAppStore\Watchdog.exeCode function: 12_2_00007FF70D311754 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,__std_fs_open_handle,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,CloseHandle,CloseHandle,12_2_00007FF70D311754
Source: C:\Users\user\PCAppStore\Watchdog.exeCode function: 12_2_00007FF70D320330 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,12_2_00007FF70D320330
Source: C:\Users\user\PCAppStore\Watchdog.exeThread delayed: delay time: 60000
Source: C:\Users\user\PCAppStore\Watchdog.exeThread delayed: delay time: 300000
Source: C:\Users\user\PCAppStore\Watchdog.exeThread delayed: delay time: 60000
Source: chrome.exe, 00000003.00000002.3731010765.00002B380224C000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware
Source: PcAppStore.exe, 00000024.00000002.2920293378.00000211E2513000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: stringComputer System ProductComputer System ProductHET3954D802742-3099-9C0E-C19B-2A23EA1FC420VMware, Inc.Noney*
Source: explorer.exe, 0000000D.00000002.3686161461.000000000962B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000D.00000000.2806245905.000000000962B000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWystem32\DriverStore\en-US\msmouse.inf_locv
Source: PcAppStore.exe, 00000024.00000002.2920293378.00000211E2513000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware, Inc.
Source: tempPOSTData.9.drBinary or memory string: {"system_stats":{"os_name":"Microsoft+Windows+10+Pro","os_installdate":"20231003105718%2E000000%2B120","os_processes":"106","os_architecture":"64-bit","os_virtmem":"8387636","os_mem":"4193332","cpu_name":"Intel%28R%29+Core%28TM%292+CPU+6600+%40+2%2E40+GHz","cpu_maxclock":"2000","cpu_cores":"4","cpu_logicalproc":"1","pc_vendor":"VMware%2C+Inc%2E","pc_version":"None","gpu_name":"MTN1MOG","gpu_ram":"0","gpu_bitsperpixel":"32","gpu_x":"1280","gpu_y":"1024","disk_name":"ZNA5AKW7+SCSI+Disk+Device","disk_size":"412300001200","sec_as":"","sec_av":"Windows+Defender","sec_fw":"","bios_releasedate":"20221121000000%2E000000%2B000"},"pcapps":{"0":"7-Zip+23%2E01+%28x64%29","1":"Mozilla+Firefox+%28x64+en-US%29","2":"Mozilla+Maintenance+Service","3":"Microsoft+Office+Professional+Plus+2019+-+en-us","4":"Microsoft+Visual+C%2B%2B+2022+X64+Additional+Runtime+-+14%2E36%2E32532","5":"Office+16+Click-to-Run+Licensing+Component","6":"Office+16+Click-to-Run+Extensibility+Component+64-bit+Registration","7":"Adobe+Acrobat+%2864-bit%29","8":"Microsoft+Visual+C%2B%2B+2022+X64+Minimum+Runtime+-+14%2E36%2E32532","9":"Google+Chrome","10":"Microsoft+Edge","11":"Microsoft+Edge+Update","12":"Microsoft+Edge+WebView2+Runtime","13":"Java+Auto+Updater","14":"Java+8+Update+381","15":"Microsoft+Visual+C%2B%2B+2015-2022+Redistributable+%28x64%29+-+14%2E36%2E32532","16":"Office+16+Click-to-Run+Extensibility+Component"},"processes":{"0":"ApplicationFrameHost%2Eexe","1":"MLLHdqUcwgfrtUaposkqsOihMsq%2Eexe","2":"Memory+Compression","3":"OfficeClickToRun%2Eexe","4":"Registry","5":"RuntimeBroker%2Eexe","6":"SearchApp%2Eexe","7":"SgrmBroker%2Eexe","8":"StartMenuExperienceHost%2Eexe","9":"System","10":"TextInputHost%2Eexe","11":"WMIADAP%2Eexe","12":"WinStore%2EApp%2Eexe","13":"WmiPrvSE%2Eexe","14":"%5BSystem+Process%5D","15":"chrome%2Eexe","16":"conhost%2Eexe","17":"csrss%2Eexe","18":"ctfmon%2Eexe","19":"dasHost%2Eexe","20":"dllhost%2Eexe","21":"dwm%2Eexe","22":"explorer%2Eexe","23":"fontdrvhost%2Eexe","24":"lsass%2Eexe","25":"nswC086%2Etmp","26":"services%2Eexe","27":"sihost%2Eexe","28":"smartscreen%2Eexe","29":"smss%2Eexe","30":"spoolsv%2Eexe","31":"svchost%2Eexe","32":"wininit%2Eexe","33":"winlogon%2Eexe"}}
Source: Watchdog.exe, 0000000C.00000003.2805050917.00000247BC0B2000.00000004.00000020.00020000.00000000.sdmp, Watchdog.exe, 0000000C.00000002.3382288112.00000247BC0A3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWt~E
Source: explorer.exe, 0000000D.00000000.2807636186.00000000098AD000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}RoamingCom
Source: Watchdog.exe, 0000000C.00000003.2805050917.00000247BC0B2000.00000004.00000020.00020000.00000000.sdmp, Watchdog.exe, 0000000C.00000002.3382288112.00000247BC0A3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWp
Source: explorer.exe, 0000000D.00000003.3075357582.000000000C5E5000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}@
Source: chrome.exe, 00000003.00000002.3733811386.00002B3802490000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: USB device added: path=\\?\usb#vid_0e0f&pid_0003#5&2dda038&0&5#{a5dcbf10-6530-11d2-901f-00c04fb951ed} vendor=3599 "VMware", product=3 "VMware Virtual USB Mouse", serial="", driver="usbccgp", guid=99c73c56-1af5-489e-a644-647127eb9ad5+8
Source: explorer.exe, 0000000D.00000002.3376933397.0000000000D99000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: #CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: Setup.exe, 00000000.00000002.2418216348.0000000002A56000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2412078675.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2149980045.0000000002A66000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2150334706.0000000002A66000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2179097055.0000000002A66000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2139676219.00000000007B4000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000002.2417415207.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2139609203.0000000002A69000.00000004.00000020.00020000.00000000.sdmp, nswC086.tmp, 00000009.00000003.2752597468.000000000065A000.00000004.00000020.00020000.00000000.sdmp, nswC086.tmp, 00000009.00000003.2909140998.0000000000646000.00000004.00000020.00020000.00000000.sdmp, nswC086.tmp, 00000009.00000002.2910972081.0000000000646000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
Source: PcAppStore.exe, 0000000B.00000002.3465025057.00000178138E0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWen-GBn
Source: nswC086.tmp, 00000009.00000002.2910972081.000000000065A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware%2C+Inc%2E
Source: chrome.exe, 00000003.00000002.3548504173.000001A4CBF47000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll*
Source: nswC086.tmp, 00000009.00000002.2910700501.0000000000621000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware, Inc.US
Source: explorer.exe, 0000000D.00000000.2791742445.00000000073E5000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000
Source: chrome.exe, 00000003.00000002.3733811386.00002B3802490000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: USB device added: path=\\?\usb#vid_0e0f&pid_0003#5&2dda038&0&5#{a5dcbf10-6530-11d2-901f-00c04fb951ed} vendor=3599 "VMware", product=3 "VMware Virtual USB Mouse", serial="", driver="usbccgp", guid=99c73c56-1af5-489e-a644-647127eb9ad5
Source: Setup.exe, 00000000.00000003.2111741891.0000000000788000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: {"system_stats":{"os_name":"Microsoft+Windows+10+Pro","os_installdate":"20231003105718%2E000000%2B120","os_processes":"106","os_architecture":"64-bit","os_virtmem":"8387636","os_mem":"4193332","cpu_name":"Intel%28R%29+Core%28TM%292+CPU+6600+%40+2%2E40+GHz","cpu_maxclock":"2000","cpu_cores":"4","cpu_logicalproc":"1","pc_vendor":"VMware%2C+Inc%2E","pc_version":"None","gpu_name":"MTN1MOG","gpu_ram":"0","gpu_bitsperpixel":"32","gpu_x":"1280","gpu_y":"1024","disk_name":"ZNA5AKW7+SCSI+Disk+Device","disk_size":"412300001200","sec_as":"","sec_av":"Windows+Defender","sec_fw":"","bios_releasedate":"20221121000000%2E000000%2B000"},"pcapps":{"0":"7-Zip+23%2E01+%28x64%29","1":"Mozilla+Firefox+%28x64+en-US%29","2":"Mozilla+Maintenance+Service","3":"Microsoft+Office+Professional+Plus+2019+-+en-us","4":"Microsoft+Visual+C%2B%2B+2022+X64+Additional+Runtime+-+14%2E36%2E32532","5":"Office+16+Click-to-Run+Licensing+Component","6":"Office+16+Click-to-Run+Extensibility+Component+64-bit+Registration","7":"Adobe+Acrobat+%2864-bit%29","8":"Microsoft+Visual+C%2B%2B+2022+X64+Minimum+Runtime+-+14%2E36%2E32532","9":"Google+Chrome","10":"Microsoft+Edge","11":"Microsoft+Edge+Update","12":"Microsoft+Edge+WebView2+Runtime","13":"Java+Auto+Updater","14":"Java+8+Update+381","15":"Microsoft+Visual+C%2B%2B+2015-2022+Redistributable+%28x64%29+-+14%2E36%2E32532","16":"Office+16+Click-to-Run+Extensibility+Component"},"processes":{"0":"ApplicationFrameHost%2Eexe","1":"MLLHdqUcwgfrtUaposkqsOihMsq%2Eexe","2":"Memory+Compression","3":"OfficeClickToRun%2Eexe","4":"Registry","5":"RuntimeBroker%2Eexe","6":"SearchApp%2Eexe","7":"Setup%2Eexe","8":"SgrmBroker%2Eexe","9":"StartMenuExperienceHost%2Eexe","10":"System","11":"TextInputHost%2Eexe","12":"WinStore%2EApp%2Eexe",
Source: PcAppStore.exe, 00000024.00000002.2920293378.00000211E24F6000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: explorer.exe, 0000000D.00000000.2807636186.00000000098AD000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000
Source: Setup.exe, 00000000.00000003.2111958559.0000000000788000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ustem_stats":{"os_name":"Microsoft+Windows+10+Pro","os_installdate":"20231003105718%2E000000%2B120","os_processes":"106","os_architecture":"64-bit","os_virtmem":"8387636","os_mem":"4193332","cpu_name":"Intel%28R%29+Core%28TM%292+CPU+6600+%40+2%2E40+GHz","cpu_maxclock":"2000","cpu_cores":"4","cpu_logicalproc":"1","pc_vendor":"VMware%2C+Inc%2E","pc_version":"None","gpu_name":"MTN1MOG","gpu_ram":"0","gpu_bitsperpixel":"32","gpu_x":"1280","gpu_y":"1024","disk_name":"ZNA5AKW7+SCSI+Disk+Device","disk_size":"412300001200","sec_as":"","sec_av":"Windows+Defender","sec_fw":"","bios_releasedate":"20221121000000%2E000000%2B000"},"pcapps":{"0":"7-Zip+23%2E01+%28x64%29","1":"Mozilla+Firefox+%28x64+en-US%29","2":"Mozilla+Maintenance+Service","3":"Microsoft+Office+Professional+Plus+2019+-+en-us","4":"Microsoft+Visual+C%2B%2B+2022+X64+Additional+Runtime+-+14%2E36%2E32532","5":"Office+16+Click-to-Run+Licensing+Component","6":"Office+16+Click-to-Run+Extensibility+Component+64-bit+Registration","7":"Adobe+Acrobat+%2864-bit%29","8":"Microsoft+Visual+C%2B%2B+2022+X64+Minimum+Runtime+-+14%2E36%2E32532","9":"Google+Chrome","10":"Microsoft+Edge","11":"Microsoft+Edge+Update","12":"Microsoft+Edge+WebView2+Runtime","13":"Java+Auto+Updater","14":"Java+8+Update+381","15":"Microsoft+Visual+C%2B%2B+2015-2022+Redistributable+%28x64%29+-+14%2E36%2E32532","16":"Office+16+Click-to-Run+Extensibility+Component"},"processes":{"0":"ApplicationFrameHost%2Eexe","1":"MLLHdqUcwgfrtUaposkqsOihMsq%2Eexe","2":"Memory+Compression","3":"OfficeClickToRun%2Eexe","4":"Registry","5":"RuntimeBroker%2Eexe","6":"SearchApp%2Eexe","7":"Setup%2Eexe","8":"SgrmBroker%2Eexe","9":"StartMenuExperienceHost%2Eexe","10":"System","11":"TextInputHost%2Eexe","12":"WinStore%2EApp%2Eexe","13":"WmiPrvSE%2Eexe","14":"%5BSystem+Process%5D","15":"backgroundTaskHost%2Eexe","16":"conhost%2Eexe","17":"csrss%2Eexe","18":"ctfmon%2Eexe","19":"dasHost%2Eexe","20":"dllhost%2Eexe","21":"dwm%2Eexe","22":"explorer%2Eexe","23":"fontdrvhost%2Eexe","24":"lsass%2Eexe","25":"services%2Eexe",
Source: Setup.exe, 00000000.00000003.2111291342.000000000075A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ustem_stats":{"os_name":"Microsoft+Windows+10+Pro","os_installdate":"20231003105718%2E000000%2B120","os_processes":"106","os_architecture":"64-bit","os_virtmem":"8387636","os_mem":"4193332","cpu_name":"Intel%28R%29+Core%28TM%292+CPU+6600+%40+2%2E40+GHz","cpu_maxclock":"2000","cpu_cores":"4","cpu_logicalproc":"1","pc_vendor":"VMware%2C+Inc%2E","pc_version":"None","gpu_name":"MTN1MOG","gpu_ram":"0","gpu_bitsperpixel":"32","gpu_x":"1280","gpu_y":"1024","disk_name":"ZNA5AKW7+SCSI+Disk+Device",
Source: explorer.exe, 0000000D.00000003.2979019689.00000000097F3000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: PcAppStore.exe, 00000024.00000002.2920293378.00000211E2513000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: mputer System ProductComputer System ProductHET3954D802742-3099-9C0E-C19B-2A23EA1FC420VMware, Inc.Noney*
Source: explorer.exe, 0000000D.00000000.2806245905.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.3686161461.000000000973C000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWws
Source: PcAppStore.exe, 00000024.00000003.2919261021.00000211E2517000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: stringComputer System ProductComputer System ProductHET3954D802742-3099-9C0E-C19B-2A23EA1FC420VMware, Inc.None+
Source: Setup.exe, 00000000.00000003.2111741891.000000000075A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ystem_stats":{"os_name":"Microsoft+Windows+10+Pro","os_installdate":"20231003105718%2E000000%2B120","os_processes":"106","os_architecture":"64-bit","os_virtmem":"8387636","os_mem":"4193332","cpu_name":"Intel%28R%29+Core%28TM%292+CPU+6600+%40+2%2E40+GHz","cpu_maxclock":"2000","cpu_cores":"4","cpu_logicalproc":"1","pc_vendor":"VMware%2C+Inc%2E","pc_version":"None","gpu_name":"MTN1MOG","gpu_ram":"0","gpu_bitsperpixel":"32","gpu_x":"1280","gpu_y":"1024","disk_name":"ZNA5AKW7+SCSI+Disk+Device",
Source: Setup.exe, 00000000.00000003.2112072071.0000000000790000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ck":"2000","cpu_cores":"4","cpu_logicalproc":"1","pc_vendor":"VMware%2C+Inc%2E","pc_version":"None","gpu_name":"MTN1MOG","gpu_ram":"0","gpu_bitsperpixel":"32","gpu_x":"1280","gpu_y":"1024","disk_name":"ZNA5AKW7+SCSI+Disk+Device","disk_size":"412300001200","sec_as":"","sec_av":"Windows+Defender","sec_fw":"","bios_releasedate":"20221121000000%2E000000%2B000"},"pcapps":{"0":"7-Zip+23%2E01+%28x64%29","1":"Mozilla+Firefox+%28x64+en-US%29","2":"Mozilla+Maintenance+Service","3":"Microsoft+Office+Professional+Plus+2019+-+en-us","4":"Microsoft+Visual+C%2B%2B+2022+X64+Additional+Runtime+-+14%2E36%2E32532","5":"Office+16+Click-to-Run+Licensing+Component","6":"Office+16+Click-to-Run+Extensibility+Component+64-bit+Registration","7":"Adobe+Acrobat+%2864-bit%29","8":"Microsoft+Visual+C%2B%2B+2022+X64+Minimum+Runtime+-+14%2E36%2E32532","9":"Google+Chrome","10":"Microsoft+Edge","11":"Microsoft+Edge+Update","12":"Microsoft+Edge+WebView2+Runtime","13":"Java+Auto+Updater","14":"Java+8+Update+381","15":"Microsoft+Visual+C%2B%2B+2015-2022+Redistributable+%28x64%29+-+14%2E36%2E32532","16":"Office+16+Click-to-Run+Extensibility+Component"},"processes":{"0":"ApplicationFrameHost%2Eexe","1":"MLLHdqUcwgfrtUaposkqsOihMsq%2Eexe","2":"Memory+Compression","3":"OfficeClickToRun%2Eexe","4":"Registry","5":"RuntimeBroker%2Eexe","6":"SearchApp%2Eexe","7":"Setup%2Eexe","8":"SgrmBroker%2Eexe","9":"StartMenuExperienceHost%2Eexe","10":"System","11":"TextInputHost%2Eexe","12":"WinStore%2EApp%2Eexe","13":"WmiPrvSE%2Eexe","14":"%5BSystem+Process%5D","15":"backgroundTaskHost%2Eexe","16":"conhost%2Eexe","17":"csrss%2Eexe","18":"ctfmon%2Eexe","19":"dasHost%2Eexe","20":"dllhost%2Eexe","21":"dwm%2Eexe","22":"explorer%2Eexe","23":"fontdrvhost%2Eexe","24":"lsass%2Eexe","25":"services%2Eexe",
Source: chrome.exe, 00000003.00000002.3752644525.00002B3802DB8000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware Virtual USB Mouse,
Source: Setup.exe, 00000000.00000002.2417415207.0000000000752000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ,"cpu_maxclock":"2000","cpu_cores":"4","cpu_logicalproc":"1","pc_vendor":"VMware%2C+Inc%2E","pc_version":"None","gpu_name":"MTN1MOG","gpu_ram":"0","gpu_bitsperpixel":"32","gpu_x":"1280","gpu_y":"1024","disk_name":"ZNA5AKW7+SCSI+Disk+Device","disk_size":"41MlX
Source: explorer.exe, 0000000D.00000000.2806245905.0000000009605000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: NXTVMWare
Source: Setup.exe, 00000000.00000003.2111291342.0000000000788000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: {"system_stats":{"os_name":"Microsoft+Windows+10+Pro","os_installdate":"20231003105718%2E000000%2B120","os_processes":"106","os_architecture":"64-bit","os_virtmem":"8387636","os_mem":"4193332","cpu_name":"Intel%28R%29+Core%28TM%292+CPU+6600+%40+2%2E40+GHz","cpu_maxclock":"2000","cpu_cores":"4","cpu_logicalproc":"1","pc_vendor":"VMware%2C+Inc%2E","pc_version":"None","gpu_name":"MTN1MOG","gpu_ram":"0","gpu_bitsperpixel":"32","gpu_x":"1280","gpu_y":"1024","disk_name":"ZNA5AKW7+SCSI+Disk+Device","disk_size":"412300001200","sec_as":"","sec_av":"Windows+Defender","sec_fw":"","bios_releasedate":"20221121000000%2E000000%2B000"},"pcapps":{
Source: explorer.exe, 0000000D.00000002.3376933397.0000000000D99000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000W
Source: explorer.exe, 0000000D.00000000.2807636186.00000000098AD000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}lnkramW6
Source: Setup.exe, 00000000.00000003.2111741891.000000000075A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 4-bit","os_virtmem":"8387636","os_mem":"4193332","cpu_name":"Intel%28R%29+Core%28TM%292+CPU+6600+%40+2%2E40+GHz","cpu_maxclock":"2000","cpu_cores":"4","cpu_logicalproc":"1","pc_vendor":"VMware%2C+Inc%2E","pc_version":"None","gpu_name":"MTN1MOG","gpu_ram":"0","gpu_bitsperpixel":"32","gpu_x":"1280","gpu_y":"1024","disk_name":"ZNA5AKW7+SCSI+Disk+Device","disk_size":"412300001200","sec_as":"","sec_av":"Windows+Defender","sec_fw":"","bios_releasedate":"20221121000000%2E000000%2B000"},"pcapps":{"0":"7-Zip+23%2E01+%28x64%29","1":"Mozilla+Firefox+%28x64+en-US%29","2":"Mozilla+Maintenance+Service","3":"Microsoft+Office+Professional+Plus+2019+-+en-us","4":"Microsoft+Visual+C%2B%2B+2022+X64+Additional+Runtime+-+14%2E36%2E32532","5":"Office+16+Click-to-Run+Licensing+Component","6":"Office+16+Click-to-Run+Extensibility+Component+64-bit+Registration","7":"Adobe+Acrobat+%2864-bit%29","8":"Microsoft+Visual+C%2B%2B+2022+X64+Minimum+Runtime+-+14%2E36%2E32532","9":"Google+Chrome","10":"Microsoft+Edge","11":"Microsoft+Edge+Update","12":"Microsoft+Edge+WebView2+Runtime","13":"Java+Auto+Updater","14":"Java+8+Update+381","15":"Microsoft+Visual+C%2B%2B+2015-2022+Redistributable+%28x64%29+-+14%2E36%2E32532","16":"Office+16+Click-to-Run+Extensibility+Component"},"processes":{"0":"ApplicationFrameHost%2Eexe","1":"MLLHdqUcwgfrtUaposkqsOihMsq%2Eexe","2":"Memory+Compression",
Source: explorer.exe, 0000000D.00000000.2819467231.000000000C474000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: %me#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94
Source: explorer.exe, 0000000D.00000003.3075357582.000000000C5E5000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}@k
Source: explorer.exe, 0000000D.00000002.3376933397.0000000000D99000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: explorer.exe, 0000000D.00000002.3376933397.0000000000D99000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: C:\Users\user\Desktop\Setup.exeAPI call chain: ExitProcess graph end nodegraph_0-3503
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpAPI call chain: ExitProcess graph end nodegraph_9-3481
Source: C:\Users\user\Desktop\Setup.exeProcess information queried: ProcessInformationJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 11_2_00007FF72FBE8CB8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,11_2_00007FF72FBE8CB8
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 11_2_00007FF72FBC1254 __vcrt_InitializeCriticalSectionEx,GetLastError,IsDebuggerPresent,OutputDebugStringW,11_2_00007FF72FBC1254
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 11_2_00007FF72FA2BFE0 atomic,RoGetActivationFactory,atomic,LoadLibraryW,GetProcAddress,RoGetActivationFactory,atomic,atomic,type_info::_name_internal_method,Concurrency::details::WorkQueue::IsStructuredEmpty,LoadLibraryW,Concurrency::details::_Scheduler::_Scheduler,GetProcAddress,atomic,11_2_00007FF72FA2BFE0
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 11_2_00007FF72F9DA620 GetProcessHeap,11_2_00007FF72F9DA620
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 11_2_00007FF72FBE8CB8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,11_2_00007FF72FBE8CB8
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 11_2_00007FF72FBE3990 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,11_2_00007FF72FBE3990
Source: C:\Users\user\PCAppStore\Watchdog.exeCode function: 12_2_00007FF70D317EA8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,12_2_00007FF70D317EA8
Source: C:\Users\user\PCAppStore\Watchdog.exeCode function: 12_2_00007FF70D31255C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,12_2_00007FF70D31255C
Source: C:\Users\user\PCAppStore\Watchdog.exeCode function: 12_2_00007FF70D312FDC IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,12_2_00007FF70D312FDC
Source: C:\Users\user\PCAppStore\Watchdog.exeCode function: 12_2_00007FF70D3131C0 SetUnhandledExceptionFilter,12_2_00007FF70D3131C0

HIPS / PFW / Operating System Protection Evasion

barindex
Found direct / indirect Syscall (likely to bypass EDR)
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeNtOpenSection: Direct from: 0x77382E0C
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeNtQueryVolumeInformationFile: Direct from: 0x77382F2C
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeNtMapViewOfSection: Direct from: 0x77382D1C
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeNtReadVirtualMemory: Direct from: 0x77382E8C
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeNtProtectVirtualMemory: Direct from: 0x77382F9C
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeNtClose: Direct from: 0x77382B6C
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeNtCreateMutant: Direct from: 0x773835CC
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeNtQueryAttributesFile: Direct from: 0x77382E6C
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeNtSetInformationProcess: Direct from: 0x77382C5C
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeNtQueryInformationProcess: Direct from: 0x77382C26
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeNtTerminateThread: Direct from: 0x77382FCC
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeNtSetInformationThread: Direct from: 0x77382ECC
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeNtOpenKeyEx: Direct from: 0x77382B9C
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeNtOpenKeyEx: Direct from: 0x77383C9C
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeNtQueryValueKey: Direct from: 0x77382BEC
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeNtDeviceIoControlFile: Direct from: 0x77382AEC
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeNtAllocateVirtualMemory: Direct from: 0x77382BFC
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeNtCreateFile: Direct from: 0x77382FEC
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeNtOpenFile: Direct from: 0x77382DCC
Source: C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exeNtAddAtomEx: Direct from: 0x7738312C
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 11_2_00007FF72FA55130 keybd_event,keybd_event,11_2_00007FF72FA55130
Source: C:\Users\user\Desktop\Setup.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://pcapp.store/installing.php?guid=4D802742-3099-9C0E-C19B-2A23EA1FC420&winver=19045&version=fa.1092c&nocache=20241106122456.947&_fcid=1730911513052455Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeProcess created: unknown unknownJump to behavior
Source: chrome.exe, 00000003.00000002.3567861989.000001A4CC740000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000D.00000000.2789754622.00000000013A0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000D.00000002.3388509681.00000000013A0000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: IProgram Manager
Source: nswC086.tmp, 00000009.00000002.2911981644.0000000002B8D000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000000B.00000000.2782815097.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpBinary or memory string: C++/WinRT version:2.0.220110.5productr_binErreCode=%dproductcreate_shortcutshortcut_erroroid=%luSHGetFolderPath_error_code=%X&oid=%luQueryInterface_error_code=%X&oid=%luCoCreateInstance_error_code=%X&oid=%lu.lnknfinityan.lnkindsnanproductshortcut_delete_erroreC=%XnfinityanindsnanShell_TrayWnd0p+00p+0unknowninfnan(ind)nannan(snan)infnan(ind)nannan(snan)infnan(ind)nannan(snan)infnan(ind)nannan(snan)unknownLTRRTLLTRinfnan(ind)nannan(snan)infnan(ind)nannan(snan)type must be string, but is type must be number, but is type must be number, but is \\\HKEY_CLASSES_ROOTHKEY_CURRENT_USERHKEY_LOCAL_MACHINEHKEY_USERSHKEY_CURRENT_CONFIGCurrentBuildBuildNumberSOFTWARE\Microsoft\Windows NT\CurrentVersionSOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon%lu%02X\/Software\Microsoft\Windows\CurrentVersion\RunSoftware\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\RunSoftware\Microsoft\Windows\CurrentVersion\RunSoftware\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\RunSoftware\PCAppStoreAppParamdefaultauto_start_oncontextual_offersperiodical_offerspersonilized_notifications%us%5B%5D=\uparamsnametype must be string, but is paramsnameurloidentryAppfilePath0e+000e+00RoGetActivationFactorycombase.dllCoIncrementMTAUsagecombase.dll^(https?://(?:www.)?([^/]+))(/.*)?$.dllDllGetActivationFactoryURL format is not valid : %wsWinHTTP 1.0handle initialization failuretimeout init failurehandle connection failureGEThandle request creation failurehandle request or response failurefile creation failurequery data not availableurloidlastTimeoTypesessionIdtagretmessageRoGetActivationFactorycombase.dllCoIncrementMTAUsagecombase.dll.dllDllGetActivationFactoryiconnamepathoidanimationsoundmenu_storemenu_searchhttps://pcapp.storenamepathmicrosoftIdregpathkeydisplaycountblinkingnotificationIconrunParampathalt_linkmicrosoftIdregpathkeyidwinGetParamsaltActionaltActionParamsid
Source: PcAppStore.exe, 0000000B.00000003.3088478867.00000178113B8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program Manager
Source: PcAppStore.exe, 0000000B.00000003.2948566228.0000017813961000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000B.00000003.2948478894.0000017813957000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Shell_TrayWndeK
Source: chrome.exe, 00000003.00000002.3567861989.000001A4CC740000.00000002.00000001.00040000.00000000.sdmp, PcAppStore.exe, PcAppStore.exe, 0000000B.00000003.2948537687.0000017813941000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000B.00000003.2948590355.0000017813947000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Shell_TrayWnd
Source: nswC086.tmp, 00000009.00000002.2911981644.0000000002B8D000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000000B.00000000.2782815097.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpBinary or memory string: productui_creation_failedcreation_error=%wsui_termination_errordirectory_switching_error.\nwjs\NW_store.exe.\ui\.ENDING_EVT_HANDLERWindows Default Lock ScreenLocalPCAppStore\productsystem_eventmsg=shutdownshutdownproductsystem_eventmsg=logofflogoff{"app":{"menu_search":{"search_request":"", "page":"b"},"show_window": "menu_search"}}ClosingEventproducttaskbar_handler_erroreCode=%luShell_TrayWndStartTrayDummySearchControlTrayButton
Source: chrome.exe, 00000003.00000002.3567861989.000001A4CC740000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000D.00000000.2789754622.00000000013A0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000D.00000002.3388509681.00000000013A0000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progman
Source: nswC086.tmp, 00000009.00000002.2911981644.0000000002B8D000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000000B.00000000.2782815097.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpBinary or memory string: list too longStartMenuExperienceHost.exeShellExperienceHost.exeexplorer.exeSearchApp.exeSearchUI.exeSearchHost.exe{"app":{"menu_search":{"search_request":"", "page":"a", "top":%d,"left":%d,"bottom":%d,"right":%d},"show_window": "menu_search"}}{"app": {"hide_window": "menu_search"}}Shell_TrayWndStartTrayDummySearchControlTrayButton
Source: explorer.exe, 0000000D.00000000.2789375663.0000000000D69000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.3376933397.0000000000D69000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: +Progman
Source: chrome.exe, 00000003.00000002.3567861989.000001A4CC740000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000D.00000000.2789754622.00000000013A0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000D.00000002.3388509681.00000000013A0000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progmanlock
Source: explorer.exe, 0000000D.00000002.3727439006.00000000098AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2979019689.00000000098AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000D.00000000.2807636186.00000000098AD000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Shell_TrayWnd31A
Source: PcAppStore.exe, 0000000B.00000003.2948537687.0000017813941000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000B.00000003.2948590355.0000017813947000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Shell_TrayWnded.x
Source: nswC086.tmp, 00000009.00000002.2911981644.0000000002B8D000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000000B.00000000.2782815097.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpBinary or memory string: TTaskbarShell_TrayWnd{"app": {"init":{"direction":"%c","screen_size":{"with_topbar":%d,"t":%d,"l":%d,"b":%d,"r":%d}}}}
Source: nswC086.tmp, 00000009.00000002.2911981644.0000000002B8D000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000000B.00000000.2782815097.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpBinary or memory string: NWidgetShell_TrayWndTrayNotifyWnd+TrayButtonPNGArial++
Source: C:\Users\user\PCAppStore\Watchdog.exeCode function: 12_2_00007FF70D3267D0 cpuid 12_2_00007FF70D3267D0
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,11_2_00007FF72FC0EACC
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetACP,11_2_00007FF72FC0E8E8
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: GetLocaleInfoEx,FormatMessageA,11_2_00007FF72FBC68B0
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: EnumSystemLocalesW,11_2_00007FF72FC0E4B0
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: EnumSystemLocalesW,11_2_00007FF72FC0E3E0
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: GetLocaleInfoEx,11_2_00007FF72FBE23BC
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW,11_2_00007FF72FC0E084
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: GetLocaleInfoEx,Concurrency::details::WorkQueue::IsStructuredEmpty,GetLocaleInfoEx,11_2_00007FF72FA47BE0
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: GetLocaleInfoW,11_2_00007FF72FC037E4
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: EnumSystemLocalesW,11_2_00007FF72FC0324C
Source: C:\Users\user\PCAppStore\Watchdog.exeCode function: GetLocaleInfoEx,FormatMessageA,12_2_00007FF70D311448
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 11_2_00007FF72FBC7B24 GetSystemTimePreciseAsFileTime,GetSystemTimeAsFileTime,11_2_00007FF72FBC7B24
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 11_2_00007FF72FC08058 _get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,11_2_00007FF72FC08058
Source: C:\Users\user\Desktop\Setup.exeCode function: 0_2_0040352D EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,ExitProcess,CoUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,0_2_0040352D
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiSpywareProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiVirusProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from FirewallProduct
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiSpywareProduct
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\nswC086.tmpWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from FirewallProduct

Stealing of Sensitive Information

barindex
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\PCAppStore\PcAppStore.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Secure PreferencesJump to behavior
Source: sr.pak.info.9.drBinary or memory string: IDS_WIN_8_1_OBSOLETE,943,../../chrome/app/chromium_strings.grd
Source: sr.pak.info.9.drBinary or memory string: IDS_WIN_XP_VISTA_OBSOLETE,940,../../chrome/app/chromium_strings.grd
Source: sr.pak.info.9.drBinary or memory string: IDS_WIN_8_OBSOLETE,942,../../chrome/app/chromium_strings.grd
Source: sr.pak.info.9.drBinary or memory string: IDS_WIN_7_OBSOLETE,941,../../chrome/app/chromium_strings.grd

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts141
Windows Management Instrumentation		1
DLL Side-Loading		1
Abuse Elevation Control Mechanism		1
Deobfuscate/Decode Files or Information		1
OS Credential Dumping		2
System Time Discovery		Remote Services1
Archive Collected Data		1
Ingress Tool Transfer		Exfiltration Over Other Network Medium1
System Shutdown/Reboot
CredentialsDomainsDefault Accounts1
Native API		1
DLL Search Order Hijacking		1
DLL Side-Loading		1
Abuse Elevation Control Mechanism		1
Input Capture		2
File and Directory Discovery		Remote Desktop Protocol1
Data from Local System		1
Encrypted Channel		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAt1
Windows Service		1
DLL Search Order Hijacking		2
Obfuscated Files or Information		Security Account Manager155
System Information Discovery		SMB/Windows Admin Shares1
Input Capture		SteganographyAutomated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCron111
Registry Run Keys / Startup Folder		1
Access Token Manipulation		1
DLL Side-Loading		NTDS1
Query Registry		Distributed Component Object Model1
Clipboard Data		Protocol ImpersonationTraffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon Script1
Windows Service		1
DLL Search Order Hijacking		LSA Secrets261
Security Software Discovery		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC Scripts12
Process Injection		1
Masquerading		Cached Domain Credentials141
Virtualization/Sandbox Evasion		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup Items111
Registry Run Keys / Startup Folder		141
Virtualization/Sandbox Evasion		DCSync3
Process Discovery		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job1
Access Token Manipulation		Proc Filesystem1
Application Window Discovery		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt12
Process Injection		/etc/passwd and /etc/shadowNetwork SniffingDirect Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1550454 Sample: Setup.exe Startdate: 06/11/2024 Architecture: WINDOWS Score: 57 85 Malicious sample detected (through community Yara rule) 2->85 87 Multi AV Scanner detection for dropped file 2->87 89 Machine Learning detection for sample 2->89 9 Setup.exe 2 42 2->9         started        process3 dnsIp4 81 167.99.235.203 DIGITALOCEAN-ASNUS United States 9->81 83 195.181.170.18 CDN77GB United Kingdom 9->83 47 C:\Users\user\AppData\Local\...\nswC086.tmp, PE32 9->47 dropped 49 C:\Users\user\AppData\Local\...\nsJSON.dll, PE32 9->49 dropped 51 C:\Users\user\AppData\Local\...\nsDialogs.dll, PE32 9->51 dropped 53 3 other files (none is malicious) 9->53 dropped 95 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 9->95 14 nswC086.tmp 11 252 9->14         started        18 chrome.exe 1 9->18         started        file5 signatures6 process7 dnsIp8 55 C:\Users\user\PCAppStore\nwjs\vulkan-1.dll, PE32+ 14->55 dropped 57 C:\Users\user\...\vk_swiftshader.dll, PE32+ 14->57 dropped 59 C:\Users\user\PCAppStore\nwjs\nw_elf.dll, PE32+ 14->59 dropped 61 17 other files (11 malicious) 14->61 dropped 97 Multi AV Scanner detection for dropped file 14->97 99 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 14->99 101 Creates multiple autostart registry keys 14->101 21 PcAppStore.exe 2 4 14->21         started        26 Watchdog.exe 14->26         started        63 192.168.2.6 unknown unknown 18->63 65 239.255.255.250 unknown Reserved 18->65 28 chrome.exe 18->28         started        30 chrome.exe 18->30         started        32 chrome.exe 6 18->32         started        file9 signatures10 process11 dnsIp12 67 37.19.194.80 INTERTELECOMUA Ukraine 21->67 69 161.35.127.181 DIGITALOCEAN-ASNUS United States 21->69 71 147.182.211.77 BV-PUBLIC-ASNUS United States 21->71 45 C:\Users\user\PCAppStore\...\Setupuser.exe, PE32 21->45 dropped 93 Tries to harvest and steal browser information (history, passwords, etc) 21->93 34 MLLHdqUcwgfrtUaposkqsOihMsq.exe 21->34 injected 37 explorer.exe 21->37 injected 39 MLLHdqUcwgfrtUaposkqsOihMsq.exe 21->39 injected 41 25 other processes 21->41 73 18.173.205.91 MIT-GATEWAYSUS United States 26->73 75 142.250.110.156 GOOGLEUS United States 28->75 77 142.250.184.226 GOOGLEUS United States 28->77 79 20 other IPs or domains 28->79 file13 signatures14 process15 signatures16 91 Found direct / indirect Syscall (likely to bypass EDR) 34->91 43 PcAppStore.exe 37->43         started        process17

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
Setup.exe100%Joe Sandbox ML

Dropped Files

SourceDetectionScannerLabelLink
C:\Users\user\AppData\Local\Temp\nscF90.tmp\Math.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nscF90.tmp\NSISFastLib.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nscF90.tmp\System.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nscF90.tmp\inetc.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nscF90.tmp\nsJSON.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsw9A21.tmp\NSISFastLib.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsw9A21.tmp\System.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsw9A21.tmp\inetc.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsw9A21.tmp\nsDialogs.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsw9A21.tmp\nsJSON.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nswC086.tmp46%ReversingLabsWin32.PUA.Generic
C:\Users\user\PCAppStore\AutoUpdater.exe5%ReversingLabs
C:\Users\user\PCAppStore\PcAppStore.exe8%ReversingLabs
C:\Users\user\PCAppStore\Uninstaller.exe29%ReversingLabs
C:\Users\user\PCAppStore\Watchdog.exe5%ReversingLabs
C:\Users\user\PCAppStore\download\Setupuser.exe18%ReversingLabs
C:\Users\user\PCAppStore\nwjs\NW_store.exe0%ReversingLabs
C:\Users\user\PCAppStore\nwjs\d3dcompiler_47.dll0%ReversingLabs
C:\Users\user\PCAppStore\nwjs\ffmpeg.dll0%ReversingLabs
C:\Users\user\PCAppStore\nwjs\libEGL.dll0%ReversingLabs
C:\Users\user\PCAppStore\nwjs\libGLESv2.dll0%ReversingLabs
C:\Users\user\PCAppStore\nwjs\node.dll0%ReversingLabs
C:\Users\user\PCAppStore\nwjs\notification_helper.exe0%ReversingLabs
C:\Users\user\PCAppStore\nwjs\nw.dll0%ReversingLabs
C:\Users\user\PCAppStore\nwjs\nw_elf.dll0%ReversingLabs
C:\Users\user\PCAppStore\nwjs\vk_swiftshader.dll0%ReversingLabs
C:\Users\user\PCAppStore\nwjs\vulkan-1.dll0%ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
http://anglebug.com/8215b0%Avira URL Cloudsafe
http://anglebug.com/7488a0%Avira URL Cloudsafe
https://delivery.pcapp.store/download.php?&src=mini_installer&file=1&mini_0%Avira URL Cloudsafe
https://td.doubleclick.n0%Avira URL Cloudsafe
http://anglebug.com/4901ocess0%Avira URL Cloudsafe
https://delivery.pcapp.store/download.php?&src=mini_installer&file=1&mini_ver=&evt_src=fa_mini_insta0%Avira URL Cloudsafe
http://anglebug.com/6876K0%Avira URL Cloudsafe
http://anglebug.com/8229(0%Avira URL Cloudsafe
https://pcapp.store_default0%Avira URL Cloudsafe
https://delivery.pcapp.store/.0%Avira URL Cloudsafe
http://anglebug.com/8280ocess0%Avira URL Cloudsafe
https://anglebug.com/7246d0%Avira URL Cloudsafe
https://pcapp.store10%Avira URL Cloudsafe
https://pcapp.st0%Avira URL Cloudsafe
http://localhost:64111/savescriptent%3Dgtag.config&rfmt=3&fmt=40%Avira URL Cloudsafe
http://anglebug.com/5421W0%Avira URL Cloudsafe
http://anglebug.com/3832%0%Avira URL Cloudsafe

Domains and IPs

Contacted Domains

⊘No contacted domains info

Contacted URLs

NameMaliciousAntivirus DetectionReputation
https://pcapp.store/?p=lpd_installing_r2&guid=4D802742-3099-9C0E-C19B-2A23EA1FC420&_fcid=1730911513052455&_winver=19045&version=fa.1092cfalse
    		high

    URLs from Memory and Binaries

    NameSourceMaliciousAntivirus DetectionReputation
    http://anglebug.com/4901ocesschrome.exe, 00000003.00000002.3738506886.00002B38026EC000.00000004.00000001.00020000.00000000.sdmpfalse
    • Avira URL Cloud: safe
    		unknown
    https://mail.google.com/mail/?usp=installed_webappchrome.exe, 00000003.00000002.3740597670.00002B3802831000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3740959914.00002B3802854000.00000004.00000001.00020000.00000000.sdmpfalse
      		high
      https://duckduckgo.com/ac/?q=chrome.exe, 00000003.00000002.3752644525.00002B3802DB8000.00000004.00000001.00020000.00000000.sdmpfalse
        		high
        https://delivery.pcapp.store/download.php?&src=mini_installer&file=1&mini_Setup.exe, 00000000.00000003.2412639264.0000000002B05000.00000004.00000020.00020000.00000000.sdmpfalse
        • Avira URL Cloud: safe
        		unknown
        http://anglebug.com/7488achrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmpfalse
        • Avira URL Cloud: safe
        		unknown
        http://dl.google.com/release2/chrome_component/imoffpf67hel7kbknqflao2oo4_1.0.2738.0/neifaoindggfcjichrome.exe, 00000003.00000002.3732007335.00002B38022F0000.00000004.00000001.00020000.00000000.sdmpfalse
          		high
          http://dl.google.com/release2/chrome_component/cxxqn654fg7hzrcrrnqcniqqye_2024.10.11.1/kiabhabjdbkjdchrome.exe, 00000003.00000002.3732007335.00002B38022F0000.00000004.00000001.00020000.00000000.sdmpfalse
            		high
            https://docs.google.com/document/Jchrome.exe, 00000003.00000002.3740597670.00002B3802831000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3740959914.00002B3802854000.00000004.00000001.00020000.00000000.sdmpfalse
              		high
              https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhonechrome.exe, 00000003.00000002.3746575735.00002B3802A38000.00000004.00000001.00020000.00000000.sdmpfalse
                		high
                https://td.doubleclick.nchrome.exe, 00000003.00000002.3737581568.00002B380262F000.00000004.00000001.00020000.00000000.sdmpfalse
                • Avira URL Cloud: safe
                		unknown
                http://anglebug.com/4633chrome.exe, 00000003.00000002.3751750048.00002B3802D38000.00000004.00000001.00020000.00000000.sdmpfalse
                  		high
                  http://www.google.com/dl/release2/chrome_component/ad3skwo2srs5xchyxzz6ujgnedha_9.52.0/gcmjkmgdlgnkkchrome.exe, 00000003.00000002.3749028177.00002B3802B60000.00000004.00000001.00020000.00000000.sdmpfalse
                    		high
                    https://anglebug.com/7382chrome.exe, 00000003.00000002.3751750048.00002B3802D38000.00000004.00000001.00020000.00000000.sdmpfalse
                      		high
                      http://anglebug.com/6876Kchrome.exe, 00000003.00000002.3751750048.00002B3802D38000.00000004.00000001.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://anglebug.com/8215bchrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      https://csp.withgoogle.com/csp/clientupdate-aus/1Cache-Control:chrome.exe, 00000003.00000002.3755493361.00002B38030B4000.00000004.00000001.00020000.00000000.sdmpfalse
                        		high
                        https://issuetracker.google.com/284462263chrome.exe, 00000003.00000002.3757797204.00002B3803240000.00000004.00000001.00020000.00000000.sdmpfalse
                          		high
                          https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0chrome.exe, 00000003.00000002.3629747706.000001A4D047D000.00000004.00000001.00040000.00000000.sdmpfalse
                            		high
                            http://anglebug.com/8229(chrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmpfalse
                            • Avira URL Cloud: safe
                            		unknown
                            https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTEklychrome.exe, 00000003.00000002.3745878341.00002B38029A0000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3745991408.00002B38029B4000.00000004.00000001.00020000.00000000.sdmpfalse
                              		high
                              https://delivery.pcapp.store/download.php?&src=mini_installer&file=1&mini_ver=&evt_src=fa_mini_instaSetup.exe, 00000000.00000002.2417315068.00000000006DA000.00000004.00000020.00020000.00000000.sdmpfalse
                              • Avira URL Cloud: safe
                              		unknown
                              https://pcapp.store/pixel.gif?guid=4D802742-3099-9C0E-C19B-2A23EA1FC420&version=fa.1092c&evt_src=fa_Setup.exe, 00000000.00000003.2411255990.0000000002AC9000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000002.2417315068.000000000073D000.00000004.00000020.00020000.00000000.sdmp, nswC086.tmp, 00000009.00000003.2752597468.000000000065A000.00000004.00000020.00020000.00000000.sdmp, nswC086.tmp, 00000009.00000003.2762283464.0000000003880000.00000004.00000020.00020000.00000000.sdmp, nswC086.tmp, 00000009.00000003.2909140998.000000000065A000.00000004.00000020.00020000.00000000.sdmp, nswC086.tmp, 00000009.00000002.2910700501.000000000060E000.00000004.00000020.00020000.00000000.sdmp, nswC086.tmp, 00000009.00000002.2910700501.00000000005B0000.00000004.00000020.00020000.00000000.sdmp, nswC086.tmp, 00000009.00000002.2910972081.000000000065A000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000B.00000002.3419764074.00000178113FD000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000B.00000002.3530749433.000001781430A000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000B.00000002.3510546907.000001781428F000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000B.00000002.3465025057.000001781391A000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000B.00000002.3530749433.00000178142FA000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000B.00000003.3152994158.00000178113FD000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000B.00000003.3088478867.00000178113FD000.00000004.00000020.00020000.00000000.sdmpfalse
                                		high
                                http://dns-tunnel-check.googlezip.net/connectchrome.exe, 00000003.00000002.3763448598.00002B380379C000.00000004.00000001.00020000.00000000.sdmpfalse
                                  		high
                                  https://dl.google.com/release2/chrome_component/adrga7eefaxjfdmmgfkiaxjg4yjq_2024.7.12.235938/eeigpnchrome.exe, 00000003.00000002.3767123957.00002B3803C6C000.00000004.00000001.00020000.00000000.sdmpfalse
                                    		high
                                    http://dl.google.com/release2/chrome_component/b3n6bzc5iojg34kogsjitu53ou_20241024.690425616.14/obedchrome.exe, 00000003.00000002.3746575735.00002B3802A38000.00000004.00000001.00020000.00000000.sdmpfalse
                                      		high
                                      https://delivery.pcapp.store/.Setup.exe, 00000000.00000003.2411255990.0000000002AD2000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000002.2418268746.0000000002AD2000.00000004.00000020.00020000.00000000.sdmpfalse
                                      • Avira URL Cloud: safe
                                      		unknown
                                      https://docs.google.com/document/:chrome.exe, 00000003.00000002.3740597670.00002B3802831000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3740959914.00002B3802854000.00000004.00000001.00020000.00000000.sdmpfalse
                                        		high
                                        https://anglebug.com/7714chrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmpfalse
                                          		high
                                          https://td.doubleclick.net/chrome.exe, 00000003.00000002.3739780957.00002B38027A0000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3756476578.00002B3803184000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3740462967.00002B380280C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3732294118.00002B3802334000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3765344060.00002B3803B30000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3762895606.00002B3803690000.00000004.00000001.00020000.00000000.sdmpfalse
                                            		high
                                            https://pcapp.store_defaultchrome.exe, 00000003.00000002.3752180609.00002B3802D96000.00000004.00000001.00020000.00000000.sdmpfalse
                                            • Avira URL Cloud: safe
                                            		unknown
                                            http://unisolated.invalid/chrome.exe, 00000003.00000002.3749452474.00002B3802BA0000.00000004.00000001.00020000.00000000.sdmpfalse
                                              		high
                                              https://www.google.com/chrome/tips/chrome.exe, 00000003.00000002.3748871032.00002B3802B40000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3745991408.00002B38029B4000.00000004.00000001.00020000.00000000.sdmpfalse
                                                		high
                                                http://www.google.com/dl/release2/chrome_component/cpx7rw4q3nwu7emczqf2w6cu7y_2023.3.30.1305/cocncanchrome.exe, 00000003.00000002.3767123957.00002B3803C6C000.00000004.00000001.00020000.00000000.sdmpfalse
                                                  		high
                                                  https://anglebug.com/7246dchrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmpfalse
                                                  • Avira URL Cloud: safe
                                                  		unknown
                                                  https://drive.google.com/?lfhs=2chrome.exe, 00000003.00000002.3740597670.00002B3802831000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3740959914.00002B3802854000.00000004.00000001.00020000.00000000.sdmpfalse
                                                    		high
                                                    http://anglebug.com/6248chrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmpfalse
                                                      		high
                                                      http://anglebug.com/5281chrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmpfalse
                                                        		high
                                                        https://www.google.com/dl/release2/chrome_component/b3n6bzc5iojg34kogsjitu53ou_20241024.690425616.14chrome.exe, 00000003.00000002.3746575735.00002B3802A38000.00000004.00000001.00020000.00000000.sdmpfalse
                                                          		high
                                                          https://pcapp.store/tos.html?guid=Setup.exe, 00000000.00000002.2417315068.00000000006DA000.00000004.00000020.00020000.00000000.sdmp, nswC086.tmp, 00000009.00000002.2910700501.00000000005FB000.00000004.00000020.00020000.00000000.sdmpfalse
                                                            		high
                                                            https://www.google.com/dl/release2/chrome_component/acccxbt6wwsvpxzpob4hojndwkqq_4.10.2830.0/oimompechrome.exe, 00000003.00000002.3749028177.00002B3802B60000.00000004.00000001.00020000.00000000.sdmpfalse
                                                              		high
                                                              https://www.youtube.com/?feature=ytcachrome.exe, 00000003.00000002.3740597670.00002B3802831000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3740959914.00002B3802854000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                		high
                                                                https://pcapp.store/?p=lpd_installing_r2&guid=4D802742-3099-9C0E-C19B-2A23EA1FC420&_fcid=17309115130chrome.exe, 00000003.00000002.3741627999.00002B3802880000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3746900734.00002B3802A64000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3731923864.00002B38022E0000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                  		high
                                                                  http://anglebug.com/8280ocesschrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                  • Avira URL Cloud: safe
                                                                  		unknown
                                                                  https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0Cross-Origin-Opener-Policy-Report-Only:chrome.exe, 00000003.00000002.3629747706.000001A4D047D000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                    		high
                                                                    https://issuetracker.google.com/255411748chrome.exe, 00000003.00000002.3757797204.00002B3803240000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                      		high
                                                                      https://csp.withgoogle.com/csp/analytics-container-tag-servingCross-Origin-Resource-Policy:chrome.exe, 00000003.00000002.3750848896.00002B3802C3C000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                        		high
                                                                        https://docs.google.com/document/u/0/create?usp=chrome_actionschrome.exe, 00000003.00000002.3745878341.00002B38029A0000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3745991408.00002B38029B4000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                          		high
                                                                          https://pcapp.store/pixelgif.phpchrome.exe, 00000003.00000002.3761783808.00002B38035B8000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3762969080.00002B38036A8000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3762274674.00002B380362C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3763998455.00002B3803818000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                            		high
                                                                            https://anglebug.com/7246chrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                              		high
                                                                              https://anglebug.com/7369chrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3746131922.00002B38029D8000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                		high
                                                                                https://anglebug.com/7489chrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                  		high
                                                                                  https://duckduckgo.com/?q=chrome.exe, 00000003.00000002.3733590482.00002B380240C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3752441724.00002B3802DA4000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                    		high
                                                                                    https://pcapp.store/pixel.gif?guid=Setup.exe, 00000000.00000002.2417415207.0000000000764000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exefalse
                                                                                      		high
                                                                                      http://dl.google.com/release2/chrome_component/j2hxfei2occ5siitujtlwgp6xi_3/ojhpjlocmbogdgmfpkhlaaeachrome.exe, 00000003.00000002.3732213913.00002B3802328000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                        		high
                                                                                        https://chrome.google.com/webstorechrome.exe, 00000003.00000002.3730818086.00002B380220C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3739647333.00002B3802784000.00000004.00000001.00020000.00000000.sdmp, PcAppStore.exe, 0000000B.00000003.3087326267.0000017814269000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000B.00000002.3465025057.00000178138E0000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000B.00000003.3087459061.000001781427B000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                          		high
                                                                                          https://pcapp.stchrome.exe, 00000003.00000002.3738971532.00002B3802740000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3742556996.00002B38028E4000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                          • Avira URL Cloud: safe
                                                                                          		unknown
                                                                                          https://tdsf.doubleclick.net/td/adfetch/gda?adg_id=163766597928&cr_id=688766820456&cv_id=0&format=$chrome.exe, 00000003.00000002.3770920960.00002B3804088000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3732294118.00002B3802334000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3765344060.00002B3803B30000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                            		high
                                                                                            http://www.google.com/dl/release2/chrome_component/ac6mhlwypzipnufijdvfyhdgvt4q_67/khaoiebndkojlmppechrome.exe, 00000003.00000002.3749950020.00002B3802C0C000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                              		high
                                                                                              https://dl.google.com/release2/chrome_component/V3P1l2hLvLw_7/7_all_sslErrorAssistant.crx3chrome.exe, 00000003.00000002.3756198806.00002B3803124000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                		high
                                                                                                https://cdn.ecosia.org/assets/images/ico/favicon.icochrome.exe, 00000003.00000002.3752644525.00002B3802DB8000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                  		high
                                                                                                  https://pcapp.storechrome.exe, 00000003.00000002.3755862205.00002B3803101000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3741820899.00002B38028BE000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3771547025.00002B38043C8000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3768474243.00002B3803D70000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3746575735.00002B3802A38000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3741820899.00002B38028C0000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3737046211.00002B38025A0000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3608907333.000001A4CFEE7000.00000004.00000001.00040000.00000000.sdmp, chrome.exe, 00000003.00000002.3759083995.00002B38032DA000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                    		high
                                                                                                    https://chrome.google.com/webstore?hl=en0chrome.exe, 00000003.00000002.3766459056.00002B3803B60000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                      		high
                                                                                                      https://doubleclick.net/Ychrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                        		high
                                                                                                        https://dl.google.com/release2/chrome_component/imoffpf67hel7kbknqflao2oo4_1.0.2738.0/neifaoindggfcjchrome.exe, 00000003.00000002.3732007335.00002B38022F0000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                          		high
                                                                                                          https://issuetracker.google.com/161903006chrome.exe, 00000003.00000002.3757797204.00002B3803240000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                            		high
                                                                                                            https://www.ecosia.org/newtab/chrome.exe, 00000003.00000002.3751750048.00002B3802D38000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                              		high
                                                                                                              http://dl.google.com/release2/chrome_component/p2zbkxfgkqyr6ljey2oe3bnzoy_2023.11.29.1201/ggkkehgbnfchrome.exe, 00000003.00000002.3755363084.00002B380308C000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                		high
                                                                                                                https://pcapp.store1chrome.exe, 00000003.00000002.3755862205.00002B3803101000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                • Avira URL Cloud: safe
                                                                                                                		unknown
                                                                                                                https://pcapp.store/chrome.exe, 00000003.00000002.3768398613.00002B3803D50000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3741820899.00002B38028B6000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3765495968.00002B3803B40000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3757797204.00002B3803240000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3731088638.00002B3802258000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3741820899.00002B38028C0000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3759803058.00002B3803314000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3608907333.000001A4CFEE7000.00000004.00000001.00040000.00000000.sdmp, chrome.exe, 00000003.00000002.3731164079.00002B3802264000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3752794412.00002B3802DD8000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3751670065.00002B3802D2C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3759083995.00002B38032DA000.00000004.00000001.00020000.00000000.sdmp, nswC086.tmp, 00000009.00000003.2752597468.000000000065A000.00000004.00000020.00020000.00000000.sdmp, nswC086.tmp, 00000009.00000003.2909140998.000000000065A000.00000004.00000020.00020000.00000000.sdmp, nswC086.tmp, 00000009.00000002.2918019684.0000000003858000.00000004.00000020.00020000.00000000.sdmp, nswC086.tmp, 00000009.00000002.2910972081.000000000065A000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000B.00000002.3510546907.0000017814268000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                  		high
                                                                                                                  http://dl.google.com/release2/chrome_component/adb2qwdrzgsbze5reot2ljihgpqa_9275/hfnkpimlhhgieaddgfechrome.exe, 00000003.00000002.3749950020.00002B3802C0C000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                    		high
                                                                                                                    https://docs.google.com/spreadsheets/u/0/create?usp=chrome_actionschrome.exe, 00000003.00000002.3745519336.00002B3802918000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                      		high
                                                                                                                      https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacychrome.exe, 00000003.00000002.3746575735.00002B3802A38000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                        		high
                                                                                                                        http://dl.google.com/release2/chrome_component/V3P1l2hLvLw_7/7_all_sslErrorAssistant.crx375//chrome.exe, 00000003.00000002.3756198806.00002B3803124000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                          		high
                                                                                                                          https://tdsf.doubleclick.net/td/adfetch/gda?adg_id=163766597928&cr_id=688766820411&cv_id=0&format=$chrome.exe, 00000003.00000002.3770920960.00002B3804088000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3765344060.00002B3803B30000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3762895606.00002B3803690000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                            		high
                                                                                                                            http://anglebug.com/3078chrome.exe, 00000003.00000002.3751750048.00002B3802D38000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                              		high
                                                                                                                              http://anglebug.com/7553chrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                		high
                                                                                                                                http://anglebug.com/5375chrome.exe, 00000003.00000002.3751750048.00002B3802D38000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                  		high
                                                                                                                                  https://tdsf.doubleclick.net/td/adfetch/gda?adg_id=163766597928&cr_id=688766820429&cv_id=0&format=$chrome.exe, 00000003.00000002.3770920960.00002B3804088000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3765344060.00002B3803B30000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3762895606.00002B3803690000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                    		high
                                                                                                                                    https://pcapp.store/piSetup.exe, 00000000.00000003.2412639264.0000000002B05000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                      		high
                                                                                                                                      https://tdsf.doubleclick.net/td/adfetch/gda?adg_id=163766597928&cr_id=688766820450&cv_ichrome.exe, 00000003.00000002.3766620489.00002B3803C0C000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                        		high
                                                                                                                                        http://anglebug.com/5371chrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                          		high
                                                                                                                                          https://m.google.com/devicemanagement/data/apichrome.exe, 00000003.00000002.3733590482.00002B380240C000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                            		high
                                                                                                                                            https://doubleclick.net/Rchrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                              		high
                                                                                                                                              https://docs.google.com/presentation/u/0/create?usp=chrome_actionschrome.exe, 00000003.00000002.3745519336.00002B3802918000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                		high
                                                                                                                                                https://googletagmanager.com/cychrome.exe, 00000003.00000002.3762747933.00002B3803674000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                  		high
                                                                                                                                                  https://tdsf.doubleclick.net/td/adfetch/gda?adg_id=163766597928&cr_id=688766820450&cv_id=0&format=$chrome.exe, 00000003.00000002.3770920960.00002B3804088000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3765344060.00002B3803B30000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3762895606.00002B3803690000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                    		high
                                                                                                                                                    http://anglebug.com/7556chrome.exe, 00000003.00000002.3740865206.00002B380283C000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                      		high
                                                                                                                                                      https://tdsf.doubleclick.net/td/adfetch/gda?adg_id=156786411258&cr_id=682239234212&cv_id=0&format=$chrome.exe, 00000003.00000002.3756476578.00002B3803184000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3732294118.00002B3802334000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3762895606.00002B3803690000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                        		high
                                                                                                                                                        http://localhost:64111/savescriptent%3Dgtag.config&rfmt=3&fmt=4chrome.exe, 00000003.00000002.3759803058.00002B3803314000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                        • Avira URL Cloud: safe
                                                                                                                                                        		unknown
                                                                                                                                                        https://chromewebstore.google.com/chrome.exe, 00000003.00000002.3730818086.00002B380220C000.00000004.00000001.00020000.00000000.sdmp, PcAppStore.exe, 0000000B.00000002.3465025057.000001781391A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                          		high
                                                                                                                                                          http://anglebug.com/5421Wchrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                          • Avira URL Cloud: safe
                                                                                                                                                          		unknown
                                                                                                                                                          https://dl.google.com/release2/chrome_component/b3n6bzc5iojg34kogsjitu53ou_20241024.690425616.14/obechrome.exe, 00000003.00000002.3746575735.00002B3802A38000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                            		high
                                                                                                                                                            https://pcapp.store/privacy.html?guid=welhttps://pcapp.store/pixel.gif?guid=&version=&evt_src=fa_minSetup.exe, 00000000.00000002.2417315068.00000000006DA000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                              		high
                                                                                                                                                              https://td.doubleclick.net/td/rul/858128210?random=1730913903715&cv=11&fst=1730913903715&fmt=3&bg=ffchrome.exe, 00000003.00000002.3767301043.00002B3803CA4000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3765495968.00002B3803B40000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3608907333.000001A4CFEE7000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                                                                                		high
                                                                                                                                                                https://clients4.google.com/chrome-syncchrome.exe, 00000003.00000002.3733313053.00002B38023C4000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                                  		high
                                                                                                                                                                  https://tdsf.doubleclick.net/td/adfetch/gda?adg_id=163766597928&cr_id=688766820414&cv_id=0&format=$chrome.exe, 00000003.00000002.3770920960.00002B3804088000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3765344060.00002B3803B30000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.3762895606.00002B3803690000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                                    		high
                                                                                                                                                                    http://anglebug.com/3832%chrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                                    • Avira URL Cloud: safe
                                                                                                                                                                    		unknown
                                                                                                                                                                    https://www.google.com/dl/release2/chrome_component/ac6mhlwypzipnufijdvfyhdgvt4q_67/khaoiebndkojlmppchrome.exe, 00000003.00000002.3753614829.00002B3802E74000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                                      		high
                                                                                                                                                                      http://anglebug.com/6692chrome.exe, 00000003.00000002.3753262847.00002B3802E3C000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                                        		high

                                                                                                                                                                        World Map of Contacted IPs

                                                                                                                                                                        • No. of IPs < 25%
                                                                                                                                                                        • 25% < No. of IPs < 50%
                                                                                                                                                                        • 50% < No. of IPs < 75%
                                                                                                                                                                        • 75% < No. of IPs

                                                                                                                                                                        Public IPs

                                                                                                                                                                        IPDomainCountryFlagASNASN NameMalicious
                                                                                                                                                                        142.250.186.68
                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                                        64.176.203.93
                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                        		11022ALABANZA-BALTUSfalse
                                                                                                                                                                        142.250.185.206
                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                                        18.173.205.91
                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                        		3MIT-GATEWAYSUSfalse
                                                                                                                                                                        142.250.186.174
                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                                        142.250.185.100
                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                                        147.182.211.77
                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                        		27555BV-PUBLIC-ASNUSfalse
                                                                                                                                                                        142.250.184.226
                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                                        161.35.127.181
                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                        		14061DIGITALOCEAN-ASNUSfalse
                                                                                                                                                                        172.217.18.98
                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                                        172.217.18.110
                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                                        142.250.186.99
                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                                        66.102.1.84
                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                                        142.250.186.138
                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                                        142.250.185.67
                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                                        1.1.1.1
                                                                                                                                                                        		unknownAustralia
                                                                                                                                                                        		13335CLOUDFLARENETUSfalse
                                                                                                                                                                        216.58.206.40
                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                                        195.181.170.18
                                                                                                                                                                        		unknownUnited Kingdom
                                                                                                                                                                        		60068CDN77GBfalse
                                                                                                                                                                        216.58.206.66
                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                                        142.250.185.110
                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                                        167.99.235.203
                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                        		14061DIGITALOCEAN-ASNUSfalse
                                                                                                                                                                        239.255.255.250
                                                                                                                                                                        		unknownReserved
                                                                                                                                                                        		unknownunknownfalse
                                                                                                                                                                        142.250.110.156
                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                                        212.102.56.178
                                                                                                                                                                        		unknownItaly
                                                                                                                                                                        		60068CDN77GBfalse
                                                                                                                                                                        37.19.194.80
                                                                                                                                                                        		unknownUkraine
                                                                                                                                                                        		31343INTERTELECOMUAfalse
                                                                                                                                                                        216.58.212.163
                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                                        45.32.1.23
                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                        		20473AS-CHOOPAUSfalse
                                                                                                                                                                        195.181.175.40
                                                                                                                                                                        		unknownUnited Kingdom
                                                                                                                                                                        		60068CDN77GBfalse
                                                                                                                                                                        142.250.186.168
                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                        		15169GOOGLEUSfalse

                                                                                                                                                                        Private

                                                                                                                                                                        IP
                                                                                                                                                                        192.168.2.6

                                                                                                                                                                        General Information

                                                                                                                                                                        Joe Sandbox version:41.0.0 Charoite
                                                                                                                                                                        Analysis ID:1550454
                                                                                                                                                                        Start date and time:2024-11-06 18:23:58 +01:00
                                                                                                                                                                        Joe Sandbox product:CloudBasic
                                                                                                                                                                        Overall analysis duration:0h 11m 2s
                                                                                                                                                                        Hypervisor based Inspection enabled:false
                                                                                                                                                                        Report type:full
                                                                                                                                                                        Cookbook file name:default.jbs
                                                                                                                                                                        Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                                                                        Number of analysed new started processes analysed:16
                                                                                                                                                                        Number of new started drivers analysed:0
                                                                                                                                                                        Number of existing processes analysed:0
                                                                                                                                                                        Number of existing drivers analysed:0
                                                                                                                                                                        Number of injected processes analysed:28
                                                                                                                                                                        Technologies:
                                                                                                                                                                        • HCA enabled
                                                                                                                                                                        • EGA enabled
                                                                                                                                                                        • AMSI enabled
                                                                                                                                                                        Analysis Mode:default
                                                                                                                                                                        Sample name:Setup.exe
                                                                                                                                                                        Detection:MAL
                                                                                                                                                                        Classification:mal57.spyw.evad.winEXE@34/288@0/30
                                                                                                                                                                        EGA Information:
                                                                                                                                                                        • Successful, ratio: 100%
                                                                                                                                                                        HCA Information:
                                                                                                                                                                        • Successful, ratio: 75%
                                                                                                                                                                        • Number of executed functions: 214
                                                                                                                                                                        • Number of non-executed functions: 115
                                                                                                                                                                        Cookbook Comments:
                                                                                                                                                                        • Found application associated with file extension: .exe

                                                                                                                                                                        Warnings

                                                                                                                                                                        • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
                                                                                                                                                                        • Not all processes where analyzed, report is missing behavior information
                                                                                                                                                                        • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                                                                                        • Report size exceeded maximum capacity and may have missing disassembly code.
                                                                                                                                                                        • Report size getting too big, too many NtEnumerateKey calls found.
                                                                                                                                                                        • Report size getting too big, too many NtOpenKey calls found.
                                                                                                                                                                        • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                                                                                        • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                                                                                                                        • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                                                                                        • Report size getting too big, too many NtSetInformationFile calls found.
                                                                                                                                                                        • Skipping network analysis since amount of network traffic is too extensive
                                                                                                                                                                        • VT rate limit hit for: Setup.exe

                                                                                                                                                                        Simulations

                                                                                                                                                                        Behavior and APIs

                                                                                                                                                                        TimeTypeDescription
                                                                                                                                                                        12:25:56API Interceptor447x Sleep call for process: Watchdog.exe modified
                                                                                                                                                                        12:25:57API Interceptor470x Sleep call for process: explorer.exe modified
                                                                                                                                                                        12:26:25API Interceptor1x Sleep call for process: PcAppStore.exe modified
                                                                                                                                                                        18:26:00AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run PCAppStore "C:\Users\user\PCAppStore\PCAppStore.exe" /init default
                                                                                                                                                                        18:26:09AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run PcAppStoreUpdater "C:\Users\user\PCAppStore\AutoUpdater.exe" /i
                                                                                                                                                                        18:26:17AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Watchdog "C:\Users\user\PCAppStore\Watchdog.exe" /guid=4D802742-3099-9C0E-C19B-2A23EA1FC420 /rid=20241106122556.806529687 /ver=fa.1092c
                                                                                                                                                                        18:26:26AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run PCAppStore "C:\Users\user\PCAppStore\PCAppStore.exe" /init default
                                                                                                                                                                        18:26:35AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run PcAppStoreUpdater "C:\Users\user\PCAppStore\AutoUpdater.exe" /i
                                                                                                                                                                        18:26:43AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Watchdog "C:\Users\user\PCAppStore\Watchdog.exe" /guid=4D802742-3099-9C0E-C19B-2A23EA1FC420 /rid=20241106122556.806529687 /ver=fa.1092c

                                                                                                                                                                        LLM Input / Output

                                                                                                                                                                        Joe Sandbox View / Context

                                                                                                                                                                        IPs

                                                                                                                                                                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                        64.176.203.93Setup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                          Setup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                            Setup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                              Setup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                18.173.205.91https://premierbb.sharefile.com/public/share/web-189361297164461cGet hashmaliciousEvilProxy, HTMLPhisherBrowse
                                                                                                                                                                                  https://u1404228.ct.sendgrid.net/ls/click?upn=u001.53NsXfgUBOeYzK87Mt8UmmFmJrZ7XUeaM2H1JJzIOlLD8XdRMGUjLjiETSkkNSOO1aPcOhsB-2B6p58337PPTvLBJHf93ZwdhKuc0pYJ3CCFhPzGYkRFXax0jGvIeRFmcP5G0BUyJ6YhdCuxj2rmKfEA3sfYg2UNxl72w1Me3oPfdrF6jbhGk315PA9TABMIUQaw-2BWiKWUThNlxL-2FiIJdoH5tiTQT-2Bm8o6f2DtPJqJqYyOmKsC6Z8r8BDMH-2BRyR0DPAbc1o4jsJAeLDJ31LwWjsFQYr3zFK5cIf8Mbd-2BRzOeXFDSMm6es3Y0fepvpPG5r7pfagssMFSYnyu8MHsVv5hRcIKJqjAZyLx1ckeV-2FaCznPfw8naJb82iSt3TNueNL1vH7DevWmKVRPxk4wZ5wzTJXKbWW9anlXuh-2BQXFzp8R8-2BdEEizEjCv3UcDuHMQ1pDH865wy4DUZnYMpZjJQJPawcQswhgRnWgvPzhIRyQE-2Bc-3DkIeO_CR4Iv1KReyG-2BUTiHEM2iSrmxUTGCd7nll-2F8pyW4fRHUIiL68JldL5hjEvlqIxpWk9hPYxNH8eo9VRHfVERALBwpMyAhjDc4FUwScFs2ucRUabaJ73tdO-2FPebairfMf4xwZ2dpDlmkqO5pmgc1gE0gGghSpi3dDGJNhz4YymAGUOPzRzAYltzk0Ba7IAVZeXH7Jn8rume2KIoU57-2Fl62ae-2FaTXSu1TIVQ6Migf-2F6NGXqO6vztNaikiQe23mzDzfi19JJ-2FVN5j6ZPVhD34lLHzKpdiifzixAZur7VZCR5Hc24MfYQGTYVbJWBIhMdpT2lgG-2Bg-2FTIWWIZlY-2Fzm-2BK3i-2F0Q-3D-3DGet hashmaliciousUnknownBrowse
                                                                                                                                                                                    147.182.211.77Setup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                      Setup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                        Setup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                          Setup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                            Setup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                              Setup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                Setup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                  161.35.127.181Setup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                    Setup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                      Setupuser.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                        https://veryfast.ioGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                          https://veryfast.ioGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            https://macdownload.informer.com/osx-fiery-master-installer/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                              9c23f857-b0b9-47d6-b664-47a3132066f4.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                9c23f857-b0b9-47d6-b664-47a3132066f4.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                  Setup (1).exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                    Setup (1).exeGet hashmaliciousUnknownBrowse

                                                                                                                                                                                                                      Domains

                                                                                                                                                                                                                      ⊘No context

                                                                                                                                                                                                                      ASNs

                                                                                                                                                                                                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                                      MIT-GATEWAYSUSPlay_VM-NowSnickinsonAudiowav012.htmlGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                      • 18.172.103.101
                                                                                                                                                                                                                      https://prezi.com/i/amopqalyrbyv/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                      • 18.66.121.214
                                                                                                                                                                                                                      https://link.edgepilot.com/s/c156b169/ta1tculxp0_Kfe6FelE-EQ?u=https://links.milanote.com/uni/ls/click?upn=u001.qLX9yCzR-2FsrNCveODBYktWd2QtsYHwBxjMjZ1TpW-2F9ng461Vm3c5YVgExxI2qEfF60jol-2FeLhYaPK8GlBsUmEiH9efaYObnhs06BMhy-2BnV9K-2FT1g-2BgCKMoIt-2BOsQ5x4z-2B0jd2R9B6J6Sadj8ZwA99g-3D-3DzV7f_2FnvF7-2FWwP6dBMnZiJJg-2FVZ56wbflsjFmFKzNzxB08Wj-2Fx2CttPGn-2F5h8MyFIcdJ3ODQy7fgm-2Fr3OjYMY9in5osqXoDc6reOgljtfQ-2FAwX1sLvCIeep1RzAkMPXrYr3uVmoIw8PZdhvqLCdI70jOD-2FqfGw6aAi7pSSe7-2BoWoH3-2Bab0SJ6OHapEhzeh0Nb40hwQ5bj2ouQCGYGMQbw31NR2JjDQjIBAubwgu2SXWETns-3DGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                      • 18.66.102.25
                                                                                                                                                                                                                      Payment Confirmation (237 KB).msgGet hashmaliciousHTMLPhisher, Tycoon2FABrowse
                                                                                                                                                                                                                      • 18.66.147.68
                                                                                                                                                                                                                      yakuza.sparc.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                      • 19.88.63.120
                                                                                                                                                                                                                      https://pub.lucidpress.com/50f1c535-8058-4eec-b469-2bd69fae4557/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                      • 18.173.205.23
                                                                                                                                                                                                                      yakuza.mipsel.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                      • 19.217.63.83
                                                                                                                                                                                                                      yakuza.arm5.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                      • 18.73.60.28
                                                                                                                                                                                                                      IGz.arm7.elfGet hashmaliciousMirai, MoobotBrowse
                                                                                                                                                                                                                      • 18.128.125.247
                                                                                                                                                                                                                      example.htmlGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                      • 18.66.122.54
                                                                                                                                                                                                                      DIGITALOCEAN-ASNUShttps://sites.google.com/view/ca7k/homeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                      • 138.68.75.10
                                                                                                                                                                                                                      2ULrUoVwTx.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                                                                                                                                                                                                      • 64.225.91.73
                                                                                                                                                                                                                      yakuza.arm5.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                      • 206.189.77.126
                                                                                                                                                                                                                      t5wABtnQtb.jsGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                      • 46.101.25.30
                                                                                                                                                                                                                      Setup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                      • 64.227.17.224
                                                                                                                                                                                                                      Setup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                      • 64.227.17.224
                                                                                                                                                                                                                      2va9zrsXLd.exeGet hashmaliciousRemcosBrowse
                                                                                                                                                                                                                      • 206.189.218.238
                                                                                                                                                                                                                      Eveshaw.pdfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                      • 159.65.213.219
                                                                                                                                                                                                                      Mandatory 2FA Authenticator - Immediate Attention Required! October 18 2024 115452(UTC).msgGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                      • 67.205.176.222
                                                                                                                                                                                                                      https://www.google.com/url?q=https%3A%2F%2Fhm.ru%2FavuRpS&sa=D&sntz=1&usg=AOvVaw3TJv_p-78LeKmDlxZZNN5yGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                      • 198.199.109.95
                                                                                                                                                                                                                      ALABANZA-BALTUSyakuza.x86.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                      • 208.56.246.184
                                                                                                                                                                                                                      Setup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                      • 64.176.203.93
                                                                                                                                                                                                                      https://lifetraces.org/wp-cron.phpGet hashmaliciousPhisherBrowse
                                                                                                                                                                                                                      • 65.108.145.65
                                                                                                                                                                                                                      Setup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                      • 64.176.203.93
                                                                                                                                                                                                                      GkyZlYczv9.dllGet hashmaliciousBumbleBeeBrowse
                                                                                                                                                                                                                      • 65.108.214.195
                                                                                                                                                                                                                      IP0XYLm4Uv.exeGet hashmaliciousStealc, VidarBrowse
                                                                                                                                                                                                                      • 65.109.243.0
                                                                                                                                                                                                                      Setup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                      • 64.176.203.93
                                                                                                                                                                                                                      Setup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                      • 64.176.203.93
                                                                                                                                                                                                                      0T32Kz4dZU.exeGet hashmaliciousStealc, VidarBrowse
                                                                                                                                                                                                                      • 65.108.249.83
                                                                                                                                                                                                                      NlpWS1Iq5Z.exeGet hashmaliciousStealc, VidarBrowse
                                                                                                                                                                                                                      • 65.108.249.83
                                                                                                                                                                                                                      BV-PUBLIC-ASNUSSetup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                      • 147.182.211.77
                                                                                                                                                                                                                      Setup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                      • 147.182.211.77
                                                                                                                                                                                                                      https://averellharriman.sharefile.com/public/share/web-s3b96c17360cd43e7bdcaf25a23709fd0Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                      • 147.182.200.48
                                                                                                                                                                                                                      Setup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                      • 147.182.211.77
                                                                                                                                                                                                                      Setup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                      • 147.182.211.77
                                                                                                                                                                                                                      Setup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                      • 147.182.211.77
                                                                                                                                                                                                                      Setup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                      • 147.182.211.77
                                                                                                                                                                                                                      Setup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                      • 147.182.211.77
                                                                                                                                                                                                                      la.bot.sh4.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                      • 147.182.236.130
                                                                                                                                                                                                                      armv4l.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                      • 147.183.0.9

                                                                                                                                                                                                                      JA3 Fingerprints

                                                                                                                                                                                                                      ⊘No context

                                                                                                                                                                                                                      Dropped Files

                                                                                                                                                                                                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\nscF90.tmp\Math.dllSetup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                        Setup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                          Setup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                            Setup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                              Setup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                https://pcapp.store/pixel.gifGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                  Setup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                    Setup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                      Setup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                        tKr6T60C1r.exeGet hashmaliciousUnknownBrowse

                                                                                                                                                                                                                                          Created / dropped Files

                                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000001d.db

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Windows\explorer.exe
                                                                                                                                                                                                                                          File Type:DIY-Thermocam raw data (Lepton 2.x), scale 0-20, spot sensor temperature 0.000000, unit celsius, color scheme 0, calibration: offset 0.000000, slope 17718035701737936663074570240.000000
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):106064
                                                                                                                                                                                                                                          Entropy (8bit):4.012704832913569
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:768:21DekxGPgHOmjk0rnaPytHJNOLNlHj8SryPIRCR1vIgPa9jm3BypTh3kXhainGxl:zkWggPytHQOhainGxnQ0BFN2KUT8l
                                                                                                                                                                                                                                          MD5:19FD69EDDCB72C07C0BE484080BEBDDE
                                                                                                                                                                                                                                          SHA1:E57869E08803F4E2D14090756F09C2B73BBE8530
                                                                                                                                                                                                                                          SHA-256:6251E42A92D08B73F0B2E343A2B89D3839500E47ECF8382365CD67151EF71E92
                                                                                                                                                                                                                                          SHA-512:9B0C077F191E6F89FB39FD6A2718DE7C5538177D36C4D4D5622F63F586593F9A1B87128E1946C84C39E0D8FEEFBA7D8654081E2C1E4316D494DB48CEDEF4B66B
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:....h... ...P...........P...............Y...p...^...........H..........W.......e.n.-.C.H.;.e.n.-.G.B.............................P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....Z.1...........user..B............................................e.n.g.i.n.e.e.r.....V.1...........AppData.@............................................A.p.p.D.a.t.a.....V.1...........Roaming.@............................................R.o.a.m.i.n.g.....\.1...........Microsoft.D............................................M.i.c.r.o.s.o.f.t.....V.1...........Windows.@............................................W.i.n.d.o.w.s.....`.1...........Start Menu..F............................................S.t.a.r.t. .M.e.n.u................(..........P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....Z.1...........user..B.........................................

                                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\p[1].gif

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):42
                                                                                                                                                                                                                                          Entropy (8bit):2.9881439641616536
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                                                                          MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                                                                          SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                                                                          SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                                                                          SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\p[2].gif

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):42
                                                                                                                                                                                                                                          Entropy (8bit):2.9881439641616536
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                                                                          MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                                                                          SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                                                                          SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                                                                          SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\p[3].gif

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):42
                                                                                                                                                                                                                                          Entropy (8bit):2.9881439641616536
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                                                                          MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                                                                          SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                                                                          SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                                                                          SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\p[4].gif

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):42
                                                                                                                                                                                                                                          Entropy (8bit):2.9881439641616536
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                                                                          MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                                                                          SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                                                                          SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                                                                          SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\p[5].gif

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):42
                                                                                                                                                                                                                                          Entropy (8bit):2.9881439641616536
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                                                                          MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                                                                          SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                                                                          SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                                                                          SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\p[6].gif

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):42
                                                                                                                                                                                                                                          Entropy (8bit):2.9881439641616536
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                                                                          MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                                                                          SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                                                                          SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                                                                          SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\p[7].gif

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):42
                                                                                                                                                                                                                                          Entropy (8bit):2.9881439641616536
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                                                                          MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                                                                          SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                                                                          SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                                                                          SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\p[8].gif

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):42
                                                                                                                                                                                                                                          Entropy (8bit):2.9881439641616536
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                                                                          MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                                                                          SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                                                                          SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                                                                          SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\p[9].gif

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):42
                                                                                                                                                                                                                                          Entropy (8bit):2.9881439641616536
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                                                                          MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                                                                          SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                                                                          SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                                                                          SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\p[1].gif

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):42
                                                                                                                                                                                                                                          Entropy (8bit):2.9881439641616536
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                                                                          MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                                                                          SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                                                                          SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                                                                          SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\p[2].gif

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):42
                                                                                                                                                                                                                                          Entropy (8bit):2.9881439641616536
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                                                                          MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                                                                          SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                                                                          SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                                                                          SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\p[3].gif

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):42
                                                                                                                                                                                                                                          Entropy (8bit):2.9881439641616536
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                                                                          MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                                                                          SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                                                                          SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                                                                          SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\p[4].gif

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):42
                                                                                                                                                                                                                                          Entropy (8bit):2.9881439641616536
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                                                                          MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                                                                          SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                                                                          SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                                                                          SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\p[5].gif

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):42
                                                                                                                                                                                                                                          Entropy (8bit):2.9881439641616536
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                                                                          MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                                                                          SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                                                                          SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                                                                          SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\p[6].gif

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):42
                                                                                                                                                                                                                                          Entropy (8bit):2.9881439641616536
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                                                                          MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                                                                          SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                                                                          SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                                                                          SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\p[7].gif

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):42
                                                                                                                                                                                                                                          Entropy (8bit):2.9881439641616536
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                                                                          MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                                                                          SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                                                                          SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                                                                          SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\p[8].gif

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):42
                                                                                                                                                                                                                                          Entropy (8bit):2.9881439641616536
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                                                                          MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                                                                          SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                                                                          SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                                                                          SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\p[9].gif

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):42
                                                                                                                                                                                                                                          Entropy (8bit):2.9881439641616536
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                                                                          MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                                                                          SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                                                                          SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                                                                          SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\p[1].gif

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):42
                                                                                                                                                                                                                                          Entropy (8bit):2.9881439641616536
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                                                                          MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                                                                          SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                                                                          SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                                                                          SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\p[2].gif

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):42
                                                                                                                                                                                                                                          Entropy (8bit):2.9881439641616536
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                                                                          MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                                                                          SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                                                                          SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                                                                          SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\p[3].gif

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):42
                                                                                                                                                                                                                                          Entropy (8bit):2.9881439641616536
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                                                                          MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                                                                          SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                                                                          SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                                                                          SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\p[4].gif

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):42
                                                                                                                                                                                                                                          Entropy (8bit):2.9881439641616536
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                                                                          MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                                                                          SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                                                                          SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                                                                          SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\p[5].gif

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):42
                                                                                                                                                                                                                                          Entropy (8bit):2.9881439641616536
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                                                                          MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                                                                          SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                                                                          SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                                                                          SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\p[7].gif

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):42
                                                                                                                                                                                                                                          Entropy (8bit):2.9881439641616536
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                                                                          MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                                                                          SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                                                                          SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                                                                          SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\p[8].gif

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):42
                                                                                                                                                                                                                                          Entropy (8bit):2.9881439641616536
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                                                                          MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                                                                          SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                                                                          SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                                                                          SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\p[9].gif

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):42
                                                                                                                                                                                                                                          Entropy (8bit):2.9881439641616536
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                                                                          MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                                                                          SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                                                                          SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                                                                          SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\p[1].gif

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):42
                                                                                                                                                                                                                                          Entropy (8bit):2.9881439641616536
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                                                                          MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                                                                          SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                                                                          SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                                                                          SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\p[2].gif

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):42
                                                                                                                                                                                                                                          Entropy (8bit):2.9881439641616536
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                                                                          MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                                                                          SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                                                                          SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                                                                          SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\p[3].gif

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):42
                                                                                                                                                                                                                                          Entropy (8bit):2.9881439641616536
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                                                                          MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                                                                          SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                                                                          SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                                                                          SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\p[4].gif

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):42
                                                                                                                                                                                                                                          Entropy (8bit):2.9881439641616536
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                                                                          MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                                                                          SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                                                                          SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                                                                          SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\p[5].gif

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):42
                                                                                                                                                                                                                                          Entropy (8bit):2.9881439641616536
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                                                                          MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                                                                          SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                                                                          SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                                                                          SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\p[6].gif

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):42
                                                                                                                                                                                                                                          Entropy (8bit):2.9881439641616536
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                                                                          MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                                                                          SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                                                                          SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                                                                          SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\p[7].gif

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):42
                                                                                                                                                                                                                                          Entropy (8bit):2.9881439641616536
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                                                                          MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                                                                          SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                                                                          SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                                                                          SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\p[8].gif

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):42
                                                                                                                                                                                                                                          Entropy (8bit):2.9881439641616536
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                                                                          MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                                                                          SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                                                                          SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                                                                          SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\p[9].gif

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):42
                                                                                                                                                                                                                                          Entropy (8bit):2.9881439641616536
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                                                                          MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                                                                          SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                                                                          SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                                                                          SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nscF90.tmp\Math.dll

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):69120
                                                                                                                                                                                                                                          Entropy (8bit):6.024967061017882
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:1536:GUZ9QC7V7IGMp2ZmtSX5p9IeJXlSM2tS:T97WSth5lwt
                                                                                                                                                                                                                                          MD5:85428CF1F140E5023F4C9D179B704702
                                                                                                                                                                                                                                          SHA1:1B51213DDBAEDFFFB7E7F098F172F1D4E5C9EFBA
                                                                                                                                                                                                                                          SHA-256:8D9A23DD2004B68C0D2E64E6C6AD330D0C648BFFE2B9F619A1E9760EF978207A
                                                                                                                                                                                                                                          SHA-512:DFE7F9F3030485CAF30EC631424120030C3985DF778993342A371BF1724FA84AA885B4E466C6F6B356D99CC24E564B9C702C7BCDD33052172E0794C2FDECCE59
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                          Joe Sandbox View:
                                                                                                                                                                                                                                          • Filename: Setup.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                          • Filename: Setup.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                          • Filename: Setup.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                          • Filename: Setup.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                          • Filename: Setup.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                          • Filename: , Detection: malicious, Browse
                                                                                                                                                                                                                                          • Filename: Setup.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                          • Filename: Setup.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                          • Filename: Setup.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                          • Filename: tKr6T60C1r.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........w.................F.........................5.....5....:6....Rich...........PE..L.....Oa...........!................KG....................................................@.............................B.......(....................................................................................................................text...b........................... ..`.rdata..R...........................@..@.data............2..................@....reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nscF90.tmp\NSISFastLib.dll

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):140288
                                                                                                                                                                                                                                          Entropy (8bit):6.334087823000165
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:3072:H5dnvmOEATceozVDkRasOCdUFZrR7beB2SK0XCC+W/ST+BeXZQUC5:ZdnvmsTceZUtCdUFZr9b4KznC5
                                                                                                                                                                                                                                          MD5:9C7A4D75F08D40AD6F5250DF6739C1B8
                                                                                                                                                                                                                                          SHA1:793749511C61B00A793D0AEA487E366256DD1B95
                                                                                                                                                                                                                                          SHA-256:6EB17C527C9E7F7FEA1FDB2EA152E957B50A56796E53CE1E5946B165B82DEAEF
                                                                                                                                                                                                                                          SHA-512:E85235307B85FFD3AAB76FF6290BEE0B3B9FD74C61A812B5355FE7B854D4C6B77BD521E52638D28E249A43D9EC7AA6F2670AF2B1C671091492C7FE19D6F9A4E6
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                          Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$......../.iTN.:TN.:TN.:.6.;^N.:.6.;.N.:.6.;@N.:.6.;UN.:...;AN.:...;DN.:...;{N.:.6.;_N.:TN.:'N.:B..;QN.:B..;UN.:B.%:UN.:TNM:UN.:B..;UN.:RichTN.:........................PE..L...z..f...........!...(.x...................................................`..............................................x...x....0..X....................@......0...............................p...@............................................text...0v.......x.................. ..`.rdata..\~...........|..............@..@.data...............................@....rsrc...X....0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nscF90.tmp\System.dll

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):12288
                                                                                                                                                                                                                                          Entropy (8bit):5.814115788739565
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
                                                                                                                                                                                                                                          MD5:CFF85C549D536F651D4FB8387F1976F2
                                                                                                                                                                                                                                          SHA1:D41CE3A5FF609DF9CF5C7E207D3B59BF8A48530E
                                                                                                                                                                                                                                          SHA-256:8DC562CDA7217A3A52DB898243DE3E2ED68B80E62DDCB8619545ED0B4E7F65A8
                                                                                                                                                                                                                                          SHA-512:531D6328DAF3B86D85556016D299798FA06FEFC81604185108A342D000E203094C8C12226A12BD6E1F89B0DB501FB66F827B610D460B933BD4AB936AC2FD8A88
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qr*.5.D.5.D.5.D...J.2.D.5.E.!.D.....2.D.a0t.1.D.V1n.4.D..3@.4.D.Rich5.D.........PE..L.....Oa...........!....."...........*.......@...............................p............@..........................B.......@..P............................`.......................................................@..X............................text.... .......".................. ..`.rdata..c....@.......&..............@..@.data...x....P.......*..............@....reloc.......`.......,..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nscF90.tmp\image.gif

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 16 x 16
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):997
                                                                                                                                                                                                                                          Entropy (8bit):4.188896534234179
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:12:2E5KZbHOjOruFw6MLxENScRVar7FC53tK1Oqd3Aa0n:tAlHOjOX60ENvRVZKbEn
                                                                                                                                                                                                                                          MD5:1636218C14C357455B5C872982E2A047
                                                                                                                                                                                                                                          SHA1:21FBD1308AF7AD25352667583A8DC340B0847DBC
                                                                                                                                                                                                                                          SHA-256:9B8B6285BF65F086E08701EEE04E57F2586E973A49C5A38660C9C6502A807045
                                                                                                                                                                                                                                          SHA-512:837FA6BCBE69A3728F5CB4C25C35C1D13E84B11232FC5279A91F21341892AD0E36003D86962C8AB1A056D3BEEB2652C754D51D6EC7EEE0E0EBFE19CD93FB5CB0
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:GIF89a............P..........4q...5j...O..F.].......................o..._.....5y.t........\....K>}...g..t....X...B..ET....t~....go..Jx...........|..U!f.|....>u.M.........w>..+r...|...A{.....t...E...b.8}....d....A.....R..y..l...w....G5u...{....t.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................!..NETSCAPE2.0.....!.......,...............H..A....`pp....~.xR......d.......,...D...)2 .1.....N` R......(@......,8RDA../..XB....P.F .....#...b`F...#8p......<\.`.........A....n|.CH...........+... .E.....d`.@......;

                                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nscF90.tmp\inetc.dll

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):39424
                                                                                                                                                                                                                                          Entropy (8bit):4.684597989866362
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:384:njt65uI9oYzcCaHjl9Cb4I1f0AGhrHXoREnRxtIpH/u0abJ2v2DW9O9tk8ZwkpwD:noHtNQoRSIwTJB6Q/kPyBp6
                                                                                                                                                                                                                                          MD5:A35CDC9CF1D17216C0AB8C5282488EAD
                                                                                                                                                                                                                                          SHA1:ED8E8091A924343AD8791D85E2733C14839F0D36
                                                                                                                                                                                                                                          SHA-256:A793929232AFB78B1C5B2F45D82094098BCF01523159FAD1032147D8D5F9C4DF
                                                                                                                                                                                                                                          SHA-512:0F15B00D0BF2AABD194302E599D69962147B4B3EF99E5A5F8D5797A7A56FD75DD9DB0A667CFBA9C758E6F0DAB9CED126A9B43948935FE37FC31D96278A842BDF
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........&.[.H.[.H.[.H.O.I.R.H.[.I...H...M.Y.H...L.Z.H...H.Z.H.....Z.H...J.Z.H.Rich[.H.................PE..L...n..c...........!.....T.........._........p............................... ............@..........................x......D...d...............................t....w..8...............................................D............................text....S.......T.................. ..`.rdata.......p.......X..............@..@.data....i...........d..............@....idata..A............v..............@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nscF90.tmp\nsJSON.dll

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):24064
                                                                                                                                                                                                                                          Entropy (8bit):5.819708895488079
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:384:n7U5CiIZ1ZC2RvhrTfldNuwQ5pk+BISivMyyOgqCoRUj+OvHxOuofnykhVQJrTU:YoZ1ZnhrTfldqk7Yyy94RxOcVQJrT
                                                                                                                                                                                                                                          MD5:F4D89D9A2A3E2F164AEA3E93864905C9
                                                                                                                                                                                                                                          SHA1:4D4E05EE5E4E77A0631A3DD064C171BA2E227D4A
                                                                                                                                                                                                                                          SHA-256:64B3EFDF3DE54E338D4DB96B549A7BDB7237BB88A82A0A63AEF570327A78A6FB
                                                                                                                                                                                                                                          SHA-512:DBDA3FE7CA22C23D2D0F2A5D9D415A96112E2965081582C7A42C139A55C5D861A27F0BD919504DE4F82C59CF7D1B97F95ED5A55E87D574635AFDB7EB2D8CADF2
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......U.'..fI_.fI_.fI_3.H^.fI_.fH_?fI_.8M^.fI_.8I^.fI_.8._.fI_.8K^.fI_Rich.fI_........PE..L...`..Z...........!.....>..........E........P............................................@..........................X......@Z..P....p..........................H....X...............................................P...............................text...W<.......>.................. ..`.rdata.......P.......B..............@..@.data...@....`.......R..............@....rsrc........p.......T..............@..@.reloc..H............X..............@..B........................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nsiF61.tmp

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):318525781
                                                                                                                                                                                                                                          Entropy (8bit):6.931313706371873
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:3145728:EEnqgvUBRlhK9QJiDS610scieJq1SXCSnsmdAGonTn:EEIKe0Djq7hCSkH
                                                                                                                                                                                                                                          MD5:1E82AC21A0AB4FB084013AC7F54B3647
                                                                                                                                                                                                                                          SHA1:152308A3F71C6CB7EADC4A6ECE3991E679CFC92F
                                                                                                                                                                                                                                          SHA-256:6A776340A1B9EC3E8094D3B46C247A3144F882D57AD976E6467407B8E09C3204
                                                                                                                                                                                                                                          SHA-512:A2F2C3C83F2FA83EEDBC3D70BF60E7DD16794B7DACD41FF2DA225034349ED2FDA070BA12F4E5E880A5B5FD81FA58B9C115B9A5812728575750704647654FDE89
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:.7......,.......,.......D...=...........^6......\7..............................................................m...........................................................................................................................................................................3................2..................................................................................................................................j.......................k...................................................................................................................s..........................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nsw9A21.tmp\NSISFastLib.dll

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\Setup.exe
                                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):140288
                                                                                                                                                                                                                                          Entropy (8bit):6.334087823000165
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:3072:H5dnvmOEATceozVDkRasOCdUFZrR7beB2SK0XCC+W/ST+BeXZQUC5:ZdnvmsTceZUtCdUFZr9b4KznC5
                                                                                                                                                                                                                                          MD5:9C7A4D75F08D40AD6F5250DF6739C1B8
                                                                                                                                                                                                                                          SHA1:793749511C61B00A793D0AEA487E366256DD1B95
                                                                                                                                                                                                                                          SHA-256:6EB17C527C9E7F7FEA1FDB2EA152E957B50A56796E53CE1E5946B165B82DEAEF
                                                                                                                                                                                                                                          SHA-512:E85235307B85FFD3AAB76FF6290BEE0B3B9FD74C61A812B5355FE7B854D4C6B77BD521E52638D28E249A43D9EC7AA6F2670AF2B1C671091492C7FE19D6F9A4E6
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                          Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$......../.iTN.:TN.:TN.:.6.;^N.:.6.;.N.:.6.;@N.:.6.;UN.:...;AN.:...;DN.:...;{N.:.6.;_N.:TN.:'N.:B..;QN.:B..;UN.:B.%:UN.:TNM:UN.:B..;UN.:RichTN.:........................PE..L...z..f...........!...(.x...................................................`..............................................x...x....0..X....................@......0...............................p...@............................................text...0v.......x.................. ..`.rdata..\~...........|..............@..@.data...............................@....rsrc...X....0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nsw9A21.tmp\System.dll

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\Setup.exe
                                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):12288
                                                                                                                                                                                                                                          Entropy (8bit):5.814115788739565
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
                                                                                                                                                                                                                                          MD5:CFF85C549D536F651D4FB8387F1976F2
                                                                                                                                                                                                                                          SHA1:D41CE3A5FF609DF9CF5C7E207D3B59BF8A48530E
                                                                                                                                                                                                                                          SHA-256:8DC562CDA7217A3A52DB898243DE3E2ED68B80E62DDCB8619545ED0B4E7F65A8
                                                                                                                                                                                                                                          SHA-512:531D6328DAF3B86D85556016D299798FA06FEFC81604185108A342D000E203094C8C12226A12BD6E1F89B0DB501FB66F827B610D460B933BD4AB936AC2FD8A88
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qr*.5.D.5.D.5.D...J.2.D.5.E.!.D.....2.D.a0t.1.D.V1n.4.D..3@.4.D.Rich5.D.........PE..L.....Oa...........!....."...........*.......@...............................p............@..........................B.......@..P............................`.......................................................@..X............................text.... .......".................. ..`.rdata..c....@.......&..............@..@.data...x....P.......*..............@....reloc.......`.......,..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nsw9A21.tmp\image.gif

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\Setup.exe
                                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 16 x 16
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):997
                                                                                                                                                                                                                                          Entropy (8bit):4.188896534234179
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:12:2E5KZbHOjOruFw6MLxENScRVar7FC53tK1Oqd3Aa0n:tAlHOjOX60ENvRVZKbEn
                                                                                                                                                                                                                                          MD5:1636218C14C357455B5C872982E2A047
                                                                                                                                                                                                                                          SHA1:21FBD1308AF7AD25352667583A8DC340B0847DBC
                                                                                                                                                                                                                                          SHA-256:9B8B6285BF65F086E08701EEE04E57F2586E973A49C5A38660C9C6502A807045
                                                                                                                                                                                                                                          SHA-512:837FA6BCBE69A3728F5CB4C25C35C1D13E84B11232FC5279A91F21341892AD0E36003D86962C8AB1A056D3BEEB2652C754D51D6EC7EEE0E0EBFE19CD93FB5CB0
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:GIF89a............P..........4q...5j...O..F.].......................o..._.....5y.t........\....K>}...g..t....X...B..ET....t~....go..Jx...........|..U!f.|....>u.M.........w>..+r...|...A{.....t...E...b.8}....d....A.....R..y..l...w....G5u...{....t.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................!..NETSCAPE2.0.....!.......,...............H..A....`pp....~.xR......d.......,...D...)2 .1.....N` R......(@......,8RDA../..XB....P.F .....#...b`F...#8p......<\.`.........A....n|.CH...........+... .E.....d`.@......;

                                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nsw9A21.tmp\inetc.dll

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\Setup.exe
                                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):39424
                                                                                                                                                                                                                                          Entropy (8bit):4.684597989866362
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:384:njt65uI9oYzcCaHjl9Cb4I1f0AGhrHXoREnRxtIpH/u0abJ2v2DW9O9tk8ZwkpwD:noHtNQoRSIwTJB6Q/kPyBp6
                                                                                                                                                                                                                                          MD5:A35CDC9CF1D17216C0AB8C5282488EAD
                                                                                                                                                                                                                                          SHA1:ED8E8091A924343AD8791D85E2733C14839F0D36
                                                                                                                                                                                                                                          SHA-256:A793929232AFB78B1C5B2F45D82094098BCF01523159FAD1032147D8D5F9C4DF
                                                                                                                                                                                                                                          SHA-512:0F15B00D0BF2AABD194302E599D69962147B4B3EF99E5A5F8D5797A7A56FD75DD9DB0A667CFBA9C758E6F0DAB9CED126A9B43948935FE37FC31D96278A842BDF
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........&.[.H.[.H.[.H.O.I.R.H.[.I...H...M.Y.H...L.Z.H...H.Z.H.....Z.H...J.Z.H.Rich[.H.................PE..L...n..c...........!.....T.........._........p............................... ............@..........................x......D...d...............................t....w..8...............................................D............................text....S.......T.................. ..`.rdata.......p.......X..............@..@.data....i...........d..............@....idata..A............v..............@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nsw9A21.tmp\modern-wizard.bmp

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\Setup.exe
                                                                                                                                                                                                                                          File Type:PC bitmap, Windows 3.x format, 164 x 314 x 4, image size 26376, resolution 2834 x 2834 px/m, cbSize 26494, bits offset 118
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):26494
                                                                                                                                                                                                                                          Entropy (8bit):1.9568109962493656
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
                                                                                                                                                                                                                                          MD5:CBE40FD2B1EC96DAEDC65DA172D90022
                                                                                                                                                                                                                                          SHA1:366C216220AA4329DFF6C485FD0E9B0F4F0A7944
                                                                                                                                                                                                                                          SHA-256:3AD2DC318056D0A2024AF1804EA741146CFC18CC404649A44610CBF8B2056CF2
                                                                                                                                                                                                                                          SHA-512:62990CB16E37B6B4EFF6AB03571C3A82DCAA21A1D393C3CB01D81F62287777FB0B4B27F8852B5FA71BC975FEAB5BAA486D33F2C58660210E115DE7E2BD34EA63
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:BM~g......v...(.......:............g..................................................................................DDD@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@DDDDDDDDDD@@@@DDDDDDDDD@@@@@@..DDD....DDDDDD........................................DDDDDDDDDD....DDDDDDDDD........DD@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@DDDDDDDDD@@@@DDDDDDDDDD@@@@@@D..DD....DDDDDDD......................................DDDDDDDDDD....DDDDDDDDDD......D..D@@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@DDDDDDDDDD@@@@DDDDDDDDDD@@@@@DDD..D.....DDDDDD......................................DDDDDDDDD.....DDDDDDDDD......DDD..@@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@DDDDDDDDDD@@@@DDDDDDDDDD@@@@@@DDDD.......DDDDDD.....................................DDDDDDDDDD....DDDDDDDDDD.....DDDDD..@@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@DDDDDDDDDD@@@@DDDDDDDDD@@@@@@DDDDDD.......DDDDDD....................................DDDDDDDDD....DDDDDDDDDD......DDDDDD..@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

                                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nsw9A21.tmp\nsDialogs.dll

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\Setup.exe
                                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):9728
                                                                                                                                                                                                                                          Entropy (8bit):5.158136237602734
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:96:o0svUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YcNqkzfS:o0svWyNO81b8pCHFcM0PuAgkOyuIFc
                                                                                                                                                                                                                                          MD5:6C3F8C94D0727894D706940A8A980543
                                                                                                                                                                                                                                          SHA1:0D1BCAD901BE377F38D579AAFC0C41C0EF8DCEFD
                                                                                                                                                                                                                                          SHA-256:56B96ADD1978B1ABBA286F7F8982B0EFBE007D4A48B3DED6A4D408E01D753FE2
                                                                                                                                                                                                                                          SHA-512:2094F0E4BB7C806A5FF27F83A1D572A5512D979EEFDA3345BAFF27D2C89E828F68466D08C3CA250DA11B01FC0407A21743037C25E94FBE688566DD7DEAEBD355
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......|..c8O`08O`08O`08Oa0.O`0.@=05O`0llP0=O`0.If09O`0.od09O`0Rich8O`0........PE..L.....Oa...........!.........0......g........0............................................@..........................6..k....0.......p...............................................................................0...............................text............................... ..`.rdata..{....0......................@..@.data...h!...@......................@....rsrc........p....... ..............@..@.reloc..~............"..............@..B................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nsw9A21.tmp\nsJSON.dll

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\Setup.exe
                                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):24064
                                                                                                                                                                                                                                          Entropy (8bit):5.819708895488079
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:384:n7U5CiIZ1ZC2RvhrTfldNuwQ5pk+BISivMyyOgqCoRUj+OvHxOuofnykhVQJrTU:YoZ1ZnhrTfldqk7Yyy94RxOcVQJrT
                                                                                                                                                                                                                                          MD5:F4D89D9A2A3E2F164AEA3E93864905C9
                                                                                                                                                                                                                                          SHA1:4D4E05EE5E4E77A0631A3DD064C171BA2E227D4A
                                                                                                                                                                                                                                          SHA-256:64B3EFDF3DE54E338D4DB96B549A7BDB7237BB88A82A0A63AEF570327A78A6FB
                                                                                                                                                                                                                                          SHA-512:DBDA3FE7CA22C23D2D0F2A5D9D415A96112E2965081582C7A42C139A55C5D861A27F0BD919504DE4F82C59CF7D1B97F95ED5A55E87D574635AFDB7EB2D8CADF2
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......U.'..fI_.fI_.fI_3.H^.fI_.fH_?fI_.8M^.fI_.8I^.fI_.8._.fI_.8K^.fI_Rich.fI_........PE..L...`..Z...........!.....>..........E........P............................................@..........................X......@Z..P....p..........................H....X...............................................P...............................text...W<.......>.................. ..`.rdata.......P.......B..............@..@.data...@....`.......R..............@....rsrc........p.......T..............@..@.reloc..H............X..............@..B........................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nswC086.tmp

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\Setup.exe
                                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):93386616
                                                                                                                                                                                                                                          Entropy (8bit):7.99999306217129
                                                                                                                                                                                                                                          Encrypted:true
                                                                                                                                                                                                                                          SSDEEP:1572864:52KX1mfH5AoIZnp9/pkhKzHjrSADzxet6X3mRsDqpszbyxjpB3ayh1sN1KGoMy1u:5jExAJh/pksTnFet6mu2G0jptggJ+flP
                                                                                                                                                                                                                                          MD5:84EE733F8014D22DAD2DFEF725489980
                                                                                                                                                                                                                                          SHA1:950A437488464103B9BF34610962C22192585BFC
                                                                                                                                                                                                                                          SHA-256:F42D2BF4A50AB0CDB4A1C43964F0429C4663E27C76D8C61AFA174A531A7819A1
                                                                                                                                                                                                                                          SHA-512:132C9BE1217804B73F8A99EA44D702E9DA0782CB6BBCC80DB2C2C72BDA1A93D06B2ADEF1B464F9163311F7482B2400553BA082C0F7F3CCF3B42C8C9B881306EB
                                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 46%
                                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf.*_9..Pf..Pg.LPf.*_;..Pf.sV..Pf..V`..Pf.Rich.Pf.........................PE..L.....Oa.................h...*......@6............@.......................... ............@.............................................HO.......... ..X)...........................................................................................text...vf.......h.................. ..`.rdata...............l..............@..@.data...x...........................@....ndata... ...............................rsrc...HO.......P..................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\temp

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):42
                                                                                                                                                                                                                                          Entropy (8bit):2.9881439641616536
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                                                                          MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                                                                          SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                                                                          SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                                                                          SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PC App Store.lnk

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Fri Oct 25 14:14:38 2024, mtime=Wed Nov 6 16:25:55 2024, atime=Fri Oct 25 14:14:38 2024, length=3116888, window=hide
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):1872
                                                                                                                                                                                                                                          Entropy (8bit):3.493844703162487
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:24:877LBPxkmA7VRU5qwtkkO6iO/7Vhfqygm:87RPxkdPiqOO6igsyg
                                                                                                                                                                                                                                          MD5:7B05D0035F6530A29AFC7A03E98FA724
                                                                                                                                                                                                                                          SHA1:DEA4627CA5A8F9406D2D59483D753BF13F1869FF
                                                                                                                                                                                                                                          SHA-256:D7D3AE77E07C7897A847625FE8ED0EAEC510DBB33E5047135BAD9E44E455E679
                                                                                                                                                                                                                                          SHA-512:57FC653CEE7885895ADEB04F162DA187FBE63DF4311853BAC1D5FF803DAAEF004AA46558D5AB38316405D303864773130063C90BB01365396F4E268BEB082D69
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:L..................F.@.. .....y..&..c...p0....y..&..X./.....................0.:..DG..Yr?.D..U..k0.&...&.......$..S.......p0...v..p0......t...CFSF..1.....fY<...PCAPPS~1....t.Y^...H.g.3..(.....gVA.G..k...F......fY+.fY<.....k.....................<.+.P.C.A.p.p.S.t.o.r.e...D.j.2.X./.YY.y .PCAPPS~1.EXE..N......YY.yfY<......"........................P.c.A.p.p.S.t.o.r.e...e.x.e.......Z...............-.......Y.............v.....C:\Users\user\PCAppStore\PcAppStore.exe..+.....\.....\.....\.....\.....\.....\.P.C.A.p.p.S.t.o.r.e.\.P.c.A.p.p.S.t.o.r.e...e.x.e...C.:.\.U.s.e.r.s.\.e.n.g.i.n.e.e.r.\.P.C.A.p.p.S.t.o.r.e.../.i.n.i.t. .d.e.f.a.u.l.t. .s.h.o.w.M.+.C.:.\.U.s.e.r.s.\.e.n.g.i.n.e.e.r.\.P.C.A.p.p.S.t.o.r.e.\.p.c.a.p.p.s.t.o.r.e...i.c.o.........%USERPROFILE%\PCAppStore\pcappstore.ico...............................................................................................................................................................................................................

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\AutoUpdater.exe

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):586584
                                                                                                                                                                                                                                          Entropy (8bit):6.337989770444409
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:6144:BYnWgtbxN7L7kYcMB/cA4hxWbZKcXErHNkQLtZ9wNmCc0r93SFzd7FSAaxXDj5w:BYnWC7sQB/cA4nLrtkWemCn9YBUxXXy
                                                                                                                                                                                                                                          MD5:693221C78FDC00A0F87FB3D1381308D4
                                                                                                                                                                                                                                          SHA1:5ABD1481B0918A1815B542BFCB2EAD542C233DB8
                                                                                                                                                                                                                                          SHA-256:6BB4786AB76767D1F9B2E19FD1A20F2F76CF1BB96127FC26741F2BE609E7680D
                                                                                                                                                                                                                                          SHA-512:A58F0A1EA54ED94EDF3129088D89F2064F7D93ECD30F9590307963B287C8FF45580DC4D9A48F6D6C4AF72DB6E1E82EEF0EA3E4BF756B93B159C3CDE808041CFD
                                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 5%
                                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............................f....f....f...............g.....gH.... ....g....Rich...........PE..d......g.........."....).....V.................@.....................................x....`.................................................P............G...P..PR......X)..........P...T.......................(.......@............................................text............................... ..`.rdata...m.......n..................@..@.data....<....... ..................@....pdata..PR...P...T... ..............@..@.rsrc....G.......H...t..............@..@.reloc..............................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\PcAppStore.exe

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):3116888
                                                                                                                                                                                                                                          Entropy (8bit):5.959240683924359
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:24576:V9kabuTUmENsEyg1IgoPYbvE8C9BHv3QJTbiNG8g9MEiYQgsSryyH2mtJXKMCSd+:V5bGEXi8mPY9pMFxu7cnZN3
                                                                                                                                                                                                                                          MD5:4B88D8ADA8D22622C30D581FC38EAA52
                                                                                                                                                                                                                                          SHA1:0980A7B75DB94035A5DE1696210648ACB95ACEDE
                                                                                                                                                                                                                                          SHA-256:D4DE255AE1109391E4A4A967A8AD66DFB70FCCA7DB47777E40815F4E7B19F2A2
                                                                                                                                                                                                                                          SHA-512:0F87422498ED3C60ED21CDA492D038D10509E3B40E5E9D7614B6CB0EF903E241AD1BA9C2F67B43D9DA3980990735A5E0C325002E43E0A41CB12947E2DBECF19F
                                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 8%
                                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l4 O.ZsO.ZsO.Zs.uYrG.Zs.u_r..Zs_.^r\.ZsFu.sM.Zs_.YrC.Zs_._r$.Zs.u^rX.Zs.u\rN.Zs.u[rf.ZsO.[s..Zs..^rM.Zs.._r~.Zs...sN.ZsO..sN.Zs..XrN.ZsRichO.Zs........PE..d......g.........."....)..&..........+"........@.............................P0....../...`...................................................*......./.P^....-......f/.X)... 0..&..0").p....................$).(.... ).@.............&.H............................text.....&.......&................. ..`.rdata...`....&..b....&.............@..@.data...H.... +.......+.............@....pdata........-.......,.............@..@.rsrc...P^..../..`..................@..@.reloc...&... 0..(...>/.............@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ReadMe.txt

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):146
                                                                                                                                                                                                                                          Entropy (8bit):4.577360416859904
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:3:TKPyFfliFRNAl2sIaRjyM1KOTxLELMZ4MKLJF8EelYq8AsXJVVWM4v:TyyFflmSssI+j1NLELM6MKn8EquZVVCv
                                                                                                                                                                                                                                          MD5:2845450EA9D938CFEA9809CA0C827F12
                                                                                                                                                                                                                                          SHA1:8DE2189530DA5923365436C37E4C55C500AC3FBF
                                                                                                                                                                                                                                          SHA-256:7FDADB3CA5B81C6D1C58A20610921BF89D63DC65B77BE982F422C6FD2A13F166
                                                                                                                                                                                                                                          SHA-512:7D19FE6E9DD51BB880FD6FBB7EE126C8078771EE5166D53F312B04D117CE2897CBB6DFB5E5627314C3CF8B56F7A2BBF5B9D38258E7912B0AC5D420B611B7C363
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:Fhis folder contains the PC App Store for Microsoft Windows.....For additional information, please visit https://pcapp.store/?p=lpd_appstore-faq..

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\Temp\tempPOSTData

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):2199
                                                                                                                                                                                                                                          Entropy (8bit):5.176050994420096
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:48:YZ1HdiyDF9hg3ZMqr8ZPfOqfYLkGYOOzfhrbTEty6WHvZNaF66/akM9hq41Dpv5p:oNdRmpMtZPPALkOOzV/qy6WHvZN06gav
                                                                                                                                                                                                                                          MD5:2320E51A083A0EB36C272BE0E6ACC904
                                                                                                                                                                                                                                          SHA1:954525103623F736313ADD928AF7EC278F75E802
                                                                                                                                                                                                                                          SHA-256:207173D6358E2F16A7FB11978417321DD441DAEBB2053E7CECAA5E12DD91D34E
                                                                                                                                                                                                                                          SHA-512:BAD81E617C9A7A210CA6564FCD714C1476CD36FB0C9B74365DD8F604DB3119A3D4687FC2906C75762F657246095798576245B60AF38351D6A460080F4BDA7F61
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:{"system_stats":{"os_name":"Microsoft+Windows+10+Pro","os_installdate":"20231003105718%2E000000%2B120","os_processes":"106","os_architecture":"64-bit","os_virtmem":"8387636","os_mem":"4193332","cpu_name":"Intel%28R%29+Core%28TM%292+CPU+6600+%40+2%2E40+GHz","cpu_maxclock":"2000","cpu_cores":"4","cpu_logicalproc":"1","pc_vendor":"VMware%2C+Inc%2E","pc_version":"None","gpu_name":"MTN1MOG","gpu_ram":"0","gpu_bitsperpixel":"32","gpu_x":"1280","gpu_y":"1024","disk_name":"ZNA5AKW7+SCSI+Disk+Device","disk_size":"412300001200","sec_as":"","sec_av":"Windows+Defender","sec_fw":"","bios_releasedate":"20221121000000%2E000000%2B000"},"pcapps":{"0":"7-Zip+23%2E01+%28x64%29","1":"Mozilla+Firefox+%28x64+en-US%29","2":"Mozilla+Maintenance+Service","3":"Microsoft+Office+Professional+Plus+2019+-+en-us","4":"Microsoft+Visual+C%2B%2B+2022+X64+Additional+Runtime+-+14%2E36%2E32532","5":"Office+16+Click-to-Run+Licensing+Component","6":"Office+16+Click-to-Run+Extensibility+Component+64-bit+Registration","7":"Ad

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\Temp\tempPOSTResponse

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):73
                                                                                                                                                                                                                                          Entropy (8bit):4.089026662492467
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:3:YGVE8fptxgDQLRv6zjQJNRvUXZ5:YGFRt9IoNaZ5
                                                                                                                                                                                                                                          MD5:3024A54E0C352ABE5EB5F753CA4828DA
                                                                                                                                                                                                                                          SHA1:DF0206851654405C8E5C2D3BC96FB536B8C2DCBF
                                                                                                                                                                                                                                          SHA-256:3CD0A703506C7394D6115D9FF721516560894358AEF07459F30D8930DF6C3B61
                                                                                                                                                                                                                                          SHA-512:D9D44051DF56B29AA596EE38463B781DBE27F917F7DAE1B2420122616DA108520429DDA58C75C7E6B2D41093F83C5A4BAE96024885AF3956F23A3CE5BD3F9358
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:{"cpg":"default","inst_excl":null,"inst_addon":null,"inst_advanced":null}

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\Uninstaller.exe

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):93880
                                                                                                                                                                                                                                          Entropy (8bit):6.891280387415397
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:1536:2msAYBdTU9fEAIS2PEtu3rLFn22G9RowU49TV1Z43kUFInU73ALu:FfY/TU9fE9PEtubZrMtkkxUUi
                                                                                                                                                                                                                                          MD5:CD8B6F1BD281C288FB3F68925639B424
                                                                                                                                                                                                                                          SHA1:25EA108C45905418B8FDA2FCCF5ADA0EDE2710E5
                                                                                                                                                                                                                                          SHA-256:808FE10CBF09F21359E1D61860BFCDDE553F5CDA38723ECD0636FA25F652121D
                                                                                                                                                                                                                                          SHA-512:A05C60EA499BEA246FF0CB3308108862CDC56BC44A4E14F546FE8AF4C52172F73F5973EBA03FF1F2BB1C575C15BF62421034C02AFA703D093B986F95A999E1B6
                                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 29%
                                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf.*_9..Pf..Pg.LPf.*_;..Pf.sV..Pf..V`..Pf.Rich.Pf.........................PE..L.....Oa.................h...*......@6............@.......................... ......f.....@.............................................HO..........`E..X)...........................................................................................text...vf.......h.................. ..`.rdata...............l..............@..@.data...x...........................@....ndata... ...............................rsrc...HO.......P..................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\Watchdog.exe

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):276312
                                                                                                                                                                                                                                          Entropy (8bit):6.155274238783893
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:3072:JNh5y0IKTcOq1wpRsrIA/uuNT4KddgLA/exq10mMfnW9L/or6RMr4T+cnOMX4Hen:jyJKA5KKdWLA/GZhnWlV94+3H3
                                                                                                                                                                                                                                          MD5:11F3801CB9FF046D6075F681971C4EB8
                                                                                                                                                                                                                                          SHA1:91572872A265185E7F9793B50C5257B511707B36
                                                                                                                                                                                                                                          SHA-256:5BD22345C42FC1B7C89C281C9247BC81DBBDB4C8EF4DA76E2A9D86589D8CC118
                                                                                                                                                                                                                                          SHA-512:B7E1A5F391E112AAC0CFA8239AD5AE784161C8734C9A4F3EF386FF617915F7AC769A5DB790B66BD95E6DAB8BAABCC4E51DE31D614193CB69909DF393DC77A021
                                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 5%
                                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........P........................H............Q.......Q.......Q..................t....P.......P&.......N......P......Rich............................PE..d......g.........."....).............,.........@.............................p...........`.....................................................x........G.......1......X)...`.......O..p....................Q..(...PN..@............................................text............................... ..`.rdata..............................@..@.data....%...........|..............@....pdata...1.......2..................@..@.rsrc....G.......H..................@..@.reloc.......`......................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\download\Setupuser.exe

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\PCAppStore\PcAppStore.exe
                                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                                                                                                                                                                                                                                          Category:modified
                                                                                                                                                                                                                                          Size (bytes):121016
                                                                                                                                                                                                                                          Entropy (8bit):7.2821762471192875
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:3072:dbG7N2kDTHUpout88qf4LuPzy5n+dmEmGCKPUY:dbE/HUiFry5n+3QY
                                                                                                                                                                                                                                          MD5:85F2849F25944FC15E58521A52B800FF
                                                                                                                                                                                                                                          SHA1:718D11673DE4743835523983AB5E06F88785A03D
                                                                                                                                                                                                                                          SHA-256:C4942BAD2EAACA0BB5ED7E6900D6C85F12F0DB6DE790072838CE3F854B9AD677
                                                                                                                                                                                                                                          SHA-512:F5723F93695E84FC41F48F0153F024249E9ABC9FD03D788AF1C31D6084ACFBE4C85A76DE55AB8BE4F68D16807BC0381C269CC3834510D538E9710F528B04BEB7
                                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 18%
                                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf.*_9..Pf..Pg.LPf.*_;..Pf.sV..Pf..V`..Pf.Rich.Pf.........................PE..L...Z.Oa.................j..........-5............@..................................*....@.............................................XO..........H...p)...........................................................................................text....h.......j.................. ..`.rdata...............n..............@..@.data...............................@....ndata... ...`...........................rsrc...XO.......P..................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\NW_store.exe

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):2312704
                                                                                                                                                                                                                                          Entropy (8bit):6.449649685576397
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:49152:gg6wrmvfu6ZPfRFq8BcvDEzT3CuaMUgKS:H8Zn3Ci
                                                                                                                                                                                                                                          MD5:E472E46BDFD736351D4B086B4C4CA134
                                                                                                                                                                                                                                          SHA1:1AA886F0CB23B3D322A43BE797D411FCA84D82A7
                                                                                                                                                                                                                                          SHA-256:E825A252B5C5C9C2DE8A6A6ADE12A7F9CD0040F6A20E6EE44BA659034E6D5223
                                                                                                                                                                                                                                          SHA-512:173F5A7ABDFEA01C9C21EC716CBA14EEC4539DA45E5734B3FD1E0688E1C22E4718BD701C25C8040D20CF48867E2A67EF2ABA46380BAB9AB1F7A42BD66FD33AFB
                                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                          Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...P0Wd.........."..........R.......R.........@.............................0$...........`.........................................',.......,..d....0........................$.@!..l...8...................@...(.......8............4..........`....................text...X........................... ..`.rdata..............................@..@.data............F..................@....pdata..............................@..@.gxfg...P........0..................@..@.retplne.............N...................tls.................P..............@....voltbl.D............T..................CPADinfo8............V..............@..._RDATA...............X..............@..@malloc_h0.... .......Z.............. ..`.rsrc........0.......\..............@..@.reloc..@!....$.."...(#.............@..B................................................................................................

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\credits.html

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:HTML document, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):9560433
                                                                                                                                                                                                                                          Entropy (8bit):4.8475056659478915
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:24576:/28lTEaiPJK0PJgVEv+F26vbV2f2EvYvAKMc/+uBPJ1PJLPJ1PJOPJDKspVosXxY:/2ETWgqSq+sIp2+qO1McdLRPiY2zXO
                                                                                                                                                                                                                                          MD5:7A32B7C762C76BD3EE38E3E998705899
                                                                                                                                                                                                                                          SHA1:E1C611A57115374A48CD84619BD06E43021B7352
                                                                                                                                                                                                                                          SHA-256:726276A62DB14DD751F32B77200E90A8000712BD256ED038BEA928C6AEF0C892
                                                                                                                                                                                                                                          SHA-512:9FE66FE4479915B0EFE12ADFB386BA251B2C2AF8CCD92B4D67F61C9D2AE537C6D3512E4379AFF10EAB3CD433FC1EDEC702E63DDFE4F83769A746FF249288D4DA
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview: Generated by licenses.py; do not edit. --><!doctype html>..<html>..<head>..<meta charset="utf-8">..<meta name="viewport" content="width=device-width">..<meta name="color-scheme" content="light dark">..<title>Credits</title>..<link rel="stylesheet" href="chrome://resources/css/text_defaults.css">..<link rel="stylesheet" href="chrome://credits/credits.css">..</head>..<body>..<span class="page-title">Credits</span>..<a id="print-link" href="#" hidden>Print</a>..<label class="show show-all" tabindex="0">..<input type="checkbox" hidden>..</label>..<div class="open-sourced">.. Chromium software is made available as source code.. <a href="https://source.chromium.org/chromium">here</a>...</div>....<div style="clear:both; overflow:auto;"> Chromium <3s the following projects -->..<div class="product">..<span class="title">2-dim General Purpose FFT (Fast Fourier/Cosine/Sine Transform) Package</span>..<span class="homepage"><a href="http://www.kurims.kyoto-u.ac.jp/~ooura/fft.html">h

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\d3dcompiler_47.dll

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):4916712
                                                                                                                                                                                                                                          Entropy (8bit):6.398049523846958
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:49152:KCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvhiD0N+YEzI4og/RfzHLeHTRhFRNc:xG2QCwmHPnog/pzHAo/A6l
                                                                                                                                                                                                                                          MD5:2191E768CC2E19009DAD20DC999135A3
                                                                                                                                                                                                                                          SHA1:F49A46BA0E954E657AAED1C9019A53D194272B6A
                                                                                                                                                                                                                                          SHA-256:7353F25DC5CF84D09894E3E0461CEF0E56799ADBC617FCE37620CA67240B547D
                                                                                                                                                                                                                                          SHA-512:5ADCB00162F284C16EC78016D301FC11559DD0A781FFBEFF822DB22EFBED168B11D7E5586EA82388E9503B0C7D3740CF2A08E243877F5319202491C8A641C970
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........|3..]...]...]..e\...]...\.5.]..e...]..wX...]..wY...]..e^...]..eX.y.]..eY...]..e]...]..eU./.]..e....]..e_...].Rich..].................PE..d...^.}`.........." ......8..........<).......................................K.....:FK...`A........................................`%G.x....(G.P.....J.@.....H.......J..%....J.....p.D.p....................S<.(...pR<.@............S<.(............................text.....8.......8................. ..`.rdata...F....8..P....8.............@..@.data...`....@G......@G.............@....pdata........H......@H.............@..@.rsrc...@.....J......@J.............@..@.reloc........J......PJ.............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\ffmpeg.dll

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):2028032
                                                                                                                                                                                                                                          Entropy (8bit):6.64708834859118
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:24576:x+QrVq8lxXjKAri3/8XLpvdZ4RAfdDY0K1w/cjWsdSJNTtMfxTCC:pdlNBfXt16RsFY0K3jWsdQVtM0C
                                                                                                                                                                                                                                          MD5:5FFF6F0423A38BFAF174CB670650F4F9
                                                                                                                                                                                                                                          SHA1:13ECD1C4784A5A178A998E9FC0DC08F556121712
                                                                                                                                                                                                                                          SHA-256:D4E6FC4E1BC6CB5B3EF7010E61D3A65E97804FB20346CEE657688339075B2727
                                                                                                                                                                                                                                          SHA-512:E6FF0EA9F6196470F6E094D0AB655FB527C28FC2B2A5D126A10C1F4185C0DFF5ED4F19E7ED717D67DF324562B7AA56ED87AA0BD396A6BA722D3141B9F30FC41B
                                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                          Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...P0Wd.........." .........D......0.........................................c...........`A.........................................T.......Z..(.....c.0.....b..|............c..2...<..8....................;..(....<..8...........8^..`............................text............................... ..`.rdata..\7.......8..................@..@.data....D......"..................@....pdata...|....b..~..................@..@.gxfg....,....c.....................@..@.retplne.....@c..........................tls.........Pc.....................@....voltbl.8....`c........................._RDATA.......pc.....................@..@.rsrc...0.....c.....................@..@.reloc...2....c..4..................@..B................................................................................................................................................................................

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\icudtl.dat

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):10717392
                                                                                                                                                                                                                                          Entropy (8bit):6.282534560973548
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:196608:hpgPBhORiuQwCliXUxbblHa93Whli6Z86WOH:n8wkDliXUxbblHa93Whli6Z8I
                                                                                                                                                                                                                                          MD5:E0F1AD85C0933ECCE2E003A2C59AE726
                                                                                                                                                                                                                                          SHA1:A8539FC5A233558EDFA264A34F7AF6187C3F0D4F
                                                                                                                                                                                                                                          SHA-256:F5170AA2B388D23BEBF98784DD488A9BCB741470384A6A9A8D7A2638D768DEFB
                                                                                                                                                                                                                                          SHA-512:714ED5AE44DFA4812081B8DE42401197C235A4FA05206597F4C7B4170DD37E8360CC75D176399B735C9AEC200F5B7D5C81C07B9AB58CBCA8DC08861C6814FB28
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:...'........CmnD........ Copyright (C) 2016 and later: Unicode, Inc. and others. License & terms of use: http://www.unicode.org/copyright.html ......E.......E.......E..P/...E.../...E..P7...E...7...E...h...F...h.. F..Pi..0F......DF.....WF.....jF..P...}F.......F..`....F.......F.. ....F.......F..0....F.......G......G......(G.....;G..@...NG......aG.....tG.......G.......G..@....G.......G.......G.......G..P....G.......H.......H..P...2H......EH..`...UH......hH......yH..P....H.......H.......H..`....H.......H.......H..P....I.......I......-I..@...=I......PI......aI..@...uI.......I...0...I.. 1...I..p1...I...e...I...e...I...i...I..`i...J...i..)J...K..BJ..p...^J..."'.uJ..P.'..J....'..J...5'..J..06'..J...>'..J..P?'..K...D'..K...F'.0K...H'.IK...V'.hK....(..K....(..K..P.)..K....)..K..pW*..K..P.*..L...*+.?L..p.+.bL....+..L...U,..L....,..L....,..L....,..L..@.,..M....,.-M..P.-.IM.. e-.`M...e-.~M...R/..M.../..M..0.0..M..@.0..M..P.0..M....0..N....0.!N...,0.9N...,0.NN..0-0.fN...-0.vN...Y0..N...Z0..N..

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\libEGL.dll

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):454144
                                                                                                                                                                                                                                          Entropy (8bit):6.3485070297294985
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:6144:yLSe7mxAked1dLX9ValhL1IA9SbD/9PAE:yExAkedHLX9VC9OKE
                                                                                                                                                                                                                                          MD5:7255FCCD39F330CA2123F380B4967E0A
                                                                                                                                                                                                                                          SHA1:C8E0E1A3E129DF7AB8922F039FFDBBA20DFBA8E2
                                                                                                                                                                                                                                          SHA-256:22C2E5452FB01513C331B9E88313830C96EB3E554FAB942AFCBD6FB8702DF730
                                                                                                                                                                                                                                          SHA-512:ECD66B0A43AEFD2C4721CD574D2394A2A9069B5258E310A0FC16C3919FD2505BFE91DB2FF8E4B5C7EF0187C86B167004659D15943F5BE6DF42BBFC297FB42119
                                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                          Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...P0Wd.........." .................7....................................................`A........................................`...h.......(.......x........A..............(...L...8...................0...(....)..8............... ............................text...2........................... ..`.rdata...}.......~..................@..@.data....O...`... ...H..............@....pdata...A.......B...h..............@..@.gxfg...`%.......&..................@..@.retplne.....0...........................tls....!....@......................@....voltbl.8....P.........................._RDATA.......`......................@..@malloc_h0....p...................... ..`.rsrc...x...........................@..@.reloc..(...........................@..B........................................................................................................................................

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\libGLESv2.dll

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):8058880
                                                                                                                                                                                                                                          Entropy (8bit):6.448026576223661
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:98304:XUoMnbHa6h5CmPt75W2+G15kI6a7Xm3rC:gDTCe4rt/aTCr
                                                                                                                                                                                                                                          MD5:6CD8726BEEFCFA69B48EAB1362A5CAD5
                                                                                                                                                                                                                                          SHA1:F4249179B86C0A870C55E6C5A263180C77017E81
                                                                                                                                                                                                                                          SHA-256:2636DA528EDCAEC9834255A92411BD5DA921D793825D74CEB997E336A0DBD393
                                                                                                                                                                                                                                          SHA-512:0F6600315B0E1B5371BB39290E5417EBAA0F3C7FB47EEF32D73AFCE299722A426DD244FD3775D88FCEB6F170F16B23B099244EE825F7F8185D58F1BF28583515
                                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                          Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...P0Wd.........." ......^...........Z.......................................{...........`A.........................................2r.......s.d.....z.......x.HX............{.|...$.q.8.....................q.(.....p.8.............s.....@1r.@....................text.....^.......^................. ..`.rdata..d....0^.......^.............@..@.data.........s.......s.............@....pdata..HX....x..Z...pw.............@..@.gxfg....,...pz.......y.............@..@.retplne......z.......y..................tls....Q.....z.......y.............@....voltbl.D.....z.......y................._RDATA........z.......y.............@..@malloc_h0.....z.......z............. ..`.rsrc.........z.......z.............@..@.reloc..|.....{.......z.............@..B........................................................................................................................................

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\af.pak

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):502905
                                                                                                                                                                                                                                          Entropy (8bit):5.409605383978337
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:12288:Mqyim2uho5EnirXKhaG1B2+H2JynyaH4IFzZo0vgElgA2W0PSq+2ss30fzO75g6p:U2uhounkXyd1B2+H2JynyaH4IFzZo0ve
                                                                                                                                                                                                                                          MD5:8032CB8A1B40AC85ACBEAFD6514BE668
                                                                                                                                                                                                                                          SHA1:EE15C360BD913FFEC94E9E36224548CA83B2564C
                                                                                                                                                                                                                                          SHA-256:1762EB36E254C02A50ED089ED737235FD7A64C0D234581612ACA56F6398CAC97
                                                                                                                                                                                                                                          SHA-512:956241DA1EE60C648417C6BF3921554F1F19AB17163DBDA764AE0DC21E1729C9357BFB900B1F948D2C649F9D53DA7CEFF3128B8CFAB34FD03053A8C37C663F5D
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:........$&).e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.(...y.....z.=...|.C...}.U.....].....b.....j.....r.....z.................................................................Y.................&.......................).................H.....]...........#.....X.....q.................9.....G.......................*.......................4................./.....L.................:.....L.................6.....E.................T.....j...........R.......................G.....d.....u.................,.....9.............................I.......................?.......................%.....m.......................6.....].....f.................(.....1.................`.....w.................:.....R.......................5...............................................P.............................~.......................~...................................p.................] ..... ..... .....!.....!.....!.....!....."....Y"....}"....."....."....9#....d#

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\af.pak.info

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\am.pak

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):813426
                                                                                                                                                                                                                                          Entropy (8bit):4.915984741122479
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:12288:dTZog2ule8/xHT9KG3Sj+KRRz0l85X9icV03OzP+Xx30jH8+j:/ogg8/xpKGCj+KRRz085X9icV03OzP+W
                                                                                                                                                                                                                                          MD5:7B88BD642C86EC4D4FB9A5614D1DA63F
                                                                                                                                                                                                                                          SHA1:92CF23267B78039E2413F7F7F90E6636614A0C5C
                                                                                                                                                                                                                                          SHA-256:0C1DE970426BA291B10CD08FF0E6B078ADF4C1D07B24E0D89D9322FD2EC2E296
                                                                                                                                                                                                                                          SHA-512:17E2381491A8844D1AD6910C3876C817ADE5CF2DAD8461771BAE9E967F7F64954917E20F8258CE6548AF1C21F8CF7E9477C7BCDCE6DD216140BF4D32410A31D9
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:........?&..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.%...s.6...t.?...v.T...w.a...y.g...z.v...|.|...}.....................................................................................0.....O.....$.......................u.....-.......................i................................... .................\.....o...........h.................f...........7.....g.....J...........\........... .............................\.............................r...........l.....+.................Z.......................z...........".....5.................B.....U.......................?...........o ..... ..... ....r!.....!....Q"....g".....".....#.....#.....#....l$.....$....6%....F%.....%.....&...."'....H'.....'....;(....u(.....(....!).....).....).....).....*.....*....C+....\+.....,.....,.....,....E-.....-....'.....`............/...../...../.....0.....0....A1.....1.....1.....2....`3.....3.....4.....4....y5.....5.... 6.....6.....7.....7.... 8.....8.....8.....9.....9.....9....p:.....:

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\am.pak.info

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\ar-XB.pak

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):822020
                                                                                                                                                                                                                                          Entropy (8bit):4.925237393732045
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:6144:vFB3t9DiYK8a4HHFLrgOIPcd1CyWpQ5fuiDbmpQ:vn3t5SzU5fu+
                                                                                                                                                                                                                                          MD5:621B390B8AF0C70D682715323A92B61F
                                                                                                                                                                                                                                          SHA1:C34B2F2C91CD0786FEBBD26223D1CB096A87C1F4
                                                                                                                                                                                                                                          SHA-256:729B677BE93020DDEF1297869CA7378D3A102927294C634A1087D63F48FB8A79
                                                                                                                                                                                                                                          SHA-512:E55691ED5FBCEF7AA8330CABDA72E9D803E12784B661A42FFE3FF725FE663AEF62EED407FDC2269135437AB7AE047A6F0CCEAA90F2349073E554DD45C5F9D0BC
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:.........&g.e.....h.....i.....j.*...k.9...l.D...n.L...o.Q...p.^...q.d...r.p...s.....t.....v.....w.....y.....z.....|.....}.........................................................................3.....N.....j...........].....!.................t...........p...........S...........}...........R...........J.....q.............................x...........H.....a...................................n.......................4.................A...........%.....A...........q.......................g.............................&.....G...........D.................!.............................A.................^ ..... ....R!....j!.....".....".....".....#.....#....,$.....$.....$....2%.....%.....&....5&.....&.....'.....(....E(.....(....P).....).....)....W*.....*....%+....R+.....+.....,.....,.....,.....-......................D/...../...../...../.....0....:1.....1.....1....o2.....2...._3.....3....s4....J5.....5.....6.....6....Y7.....7.....7.....8....'9....}9.....9....!:.....:.....:.....;.....;....M<.....<

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\ar-XB.pak.info

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\ar.pak

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):897122
                                                                                                                                                                                                                                          Entropy (8bit):4.928723053414015
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:12288:CIPFaBsPG/d/RXZwRq4fvPU7XUUk/K58N0j+JzIQ4pF:CIvAAC5h+c
                                                                                                                                                                                                                                          MD5:3C8E3C5B1D029E9A01943DDBA053C37F
                                                                                                                                                                                                                                          SHA1:785EE0C46B11A19C80770F2B310057E59D90C2E1
                                                                                                                                                                                                                                          SHA-256:98CD654847FF28C0EE580A7374276EE5BD2A38DDE8F45ADFBACBD7917E4C026D
                                                                                                                                                                                                                                          SHA-512:DCA2FC0BE678BEBF047DBAA5A71C01AD57F9B463E3F80DBFABC0937BCFDCEEFC8AE84FD415C40D0B6B713FFF24CEBFB84373ECDDE3741F78265E082C5B9951D0
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:.........%Q.e.>...h.B...i.M...j.Y...k.h...l.s...n.{...o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}.........................%.....-.....4.....;.....B.....D.....I.....b...................................o...........,...........#.....E.......................0.......................$...........?.........................................x...........\...........\...........n...........s.....C.......................(.....{...........J...................................4.....s.............................r.................1...........;.....{...........K...... ....u ..... .....!.....!.....!.....!.....".....#....r#.....#.....$.....$.....$.....$....w%.....%....C&....X&.....&.....'.....'.....(.....(.....)....C)....i).....)....d*.....*....C+.....+....:,....X,.....,....{-.....-......................./.... /...../....C0.....0.....0....91.....1.....1.....2.....3.....3.....4.....4.....5.....6....e6.....6....+7.....7.....7.....8....g8.....8.....8.....9.....9....k:.....:.....:.....;

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\ar.pak.info

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\bg.pak

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):927865
                                                                                                                                                                                                                                          Entropy (8bit):4.686646990438899
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:24576:4Tax7YKC3cquMMLYzzQkECPUwVbtbHp373ZL+3aAKHkVDYyKzumpod2nm5g0XuGq:W8C3cquMMLYUKUwVbtbHp373Zq3arkV8
                                                                                                                                                                                                                                          MD5:27C55B97D549BCF13145EC75F0A503CA
                                                                                                                                                                                                                                          SHA1:4D7BEC85366FBB602EB6FC02297FB402BD40B6BF
                                                                                                                                                                                                                                          SHA-256:F2EB47878B5D34589A2AFC2E74AB346003BF4D2C450230B9CFD084935BB54A4D
                                                                                                                                                                                                                                          SHA-512:CA3ABB2403B8A67A53F2156E11C361B137F45378737E39D45D5F77148FF3CD031E37DB9EA144B76749667CBA20698C2049E86CA5927475B1E22112751B9BDF3F
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:........$&).e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.(...y.....z.=...|.C...}.U.....].....b.....j.....r.....z................................................................. .............................K...........................................................V.........................................^...........p...................................&.....n.....X.............................L...................................I.....\.....5.......................E ..... ..... ....R!.....!....5"....]".....".....#.....#.....#.....$....?%.....%.....%....h&.....&....<'....['.....'....n(.....(.....(....g).....)....#*....I*.....*....|+.....+.....+.....,.....-....}...........Y/...../....'0....W0.....0...._1.....1.....1.....2....w3.....3.....4.....5.....5....06.....6....L7.....7.....8....A8.....9.....9.....:....8:....&;.....;....;<....p<....`=....;>.....>.....?.....?.....@....7A.....A....LB.....B....?C....wC.....D.....D.....D.....E.....F.....F....hG

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\bg.pak.info

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\bn.pak

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):1193463
                                                                                                                                                                                                                                          Entropy (8bit):4.299730648702171
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:3072:o3d2APzZl1uPXdf826YBWviytaGHFGuzhr0Ylf14/QISydDbrK8VBbFKQg51lNDS:o3d3Fl18fPAtt1MFSydHrK8VBbG5llA
                                                                                                                                                                                                                                          MD5:7351AE61AE5884088AE68CE5BE0043D8
                                                                                                                                                                                                                                          SHA1:DBEEA5DA228F63A405548F0E6F82FBBB3D624058
                                                                                                                                                                                                                                          SHA-256:D367339A1AC5CE27E58AA03D33E567C06C02F4AC87DB26ACA5D8A3D915AAA01A
                                                                                                                                                                                                                                          SHA-512:85D5D0372C162DE8660B4A8A4EC493585C6C3D29F999F1734C319532DB572A13C91C87320BE139F9FFA957ADD52CDC36584226FAF5AFC39F8A82A2E9C146156B
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:........%&(.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.'...w.4...y.:...z.I...|.O...}.a.....i.....n.....v.....~.......................................................................Y.................I...........z.....Q...........*.....O.....I...........F.....>.............................G.......................G.............................Q.................t...........Z.....I.............................K.............................]............ .....!....Q"....."....n#.....$....L$.....$....'%.....%.....%.....&.....&....H'....{'.....'....~(....-).....).....).....*....(+.....+.....+....s,.....-....g-.....-....5...........!/....D/...../.....0.....0.....1..../2....K3.....4....^4....X5....'6.....6.....6.....7.....8....L8....|8....J9.....:....w:.....:.....;....d<.....<....s=....->.....>.....?....??....$@.....@....-A....eA....hB.....C.....C.....C....)E....}F....pG.....G.....H.....I.....J.....J.....K.....L.....L....0M.....M.....N....7O....fO....lP....@Q

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\bn.pak.info

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\ca.pak

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):573774
                                                                                                                                                                                                                                          Entropy (8bit):5.391859865204477
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:12288:gQQL7QREpAp973K5PqF4N3Mw2juwHzejm0t3lvqbETX9/RSHhIsjcmlLEYuCJkdz:hb9zaBRnvWDMN8UpOO5k/mVb
                                                                                                                                                                                                                                          MD5:F6E50323E0C5A657EBDC2FE7285C15F6
                                                                                                                                                                                                                                          SHA1:944356D207A7962A81801BB76B0E2C5226FF7F1E
                                                                                                                                                                                                                                          SHA-256:DE474CF24B68B6D862C96B8057EDE3F53C6F63C46532E4988E9D1979B1CF59DA
                                                                                                                                                                                                                                          SHA-512:8BC4EA1E2EB03E0423A7C3008BF6001B904928B5B7D7E84D61469C8D8CDBD34E9A4FFFA900B7CBF4216FBA3A469D7A26AF9C22E618902C28044F426693B09EC7
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:........"&+.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.$...y.*...z.9...|.?...}.Q.....Y.....^.....f.....n.....v.....}.................................................................9.................3...................................n.................P.......................T.......................K.....~.................y.................n...........$.....J.................^.....r...........,.....c.....w...........U.................Q...........5.....[.................<.....X.......................(......................................... .....5.......................1.............................[.......................>.......................^.................0.......................3.......................V.......................t.................Z.................. ....7 ..... ..... .....!....(!.....!.....!....6"....R"....."....w#.....#.....$.....$.....$....0%....Z%.....%....)&....\&....|&.....&.....'....='....P'.....'....((....h(.....(

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\ca.pak.info

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\cs.pak

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):583431
                                                                                                                                                                                                                                          Entropy (8bit):5.838398613999325
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:12288:eV2UufpvPlAhTbe65aU8rwsiNOA3SzmPN:eV2UufpvNAhHh5aU8rvYOrzmPN
                                                                                                                                                                                                                                          MD5:7F1AD2897B210C4C25CFBDF0736F6809
                                                                                                                                                                                                                                          SHA1:62E0335A63BC9E2AE8A9826E08256B00E433D9F5
                                                                                                                                                                                                                                          SHA-256:E0826C8E2FE737307D09D808BC693A397E0F1E093AC249B24CEB48327685A4A4
                                                                                                                                                                                                                                          SHA-512:C656B1FF7FCD93B3AEF5FC9E91373D0588520546EAF6CB5E2F965FD66ED0D60E2C04FB22155723D6EFDFDB377EF98CD6420F9944C5B0FC4AE8DE14C830A05B15
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:.........&;.e.j...h.n...i.v...j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}.1.....9.....>.....F.....N.....V.....].....d.....k.....l.....m.....o.............................T...........G.....e...........).....^.....m...........p.................V.......................{.................$.....w.......................z.................7...........H.................$.......................N.......................w...........2.....G...........B.......................Q.....n.................*.....V.....h................./.....@.................F.....Z.................R.....d.................9.....F.................H.....[...........*.....d.....x...........m.......................`.....{.................0.....Q.....p...........7.....c.....y...........Y.......................w.................. ..... ..... ..... ....I!.....!.....!....."....t"....."....0#....B#.....#....T$.....$.....$....2%.....%.....%.....%....<&.....&.....&.....&....@'.....'.....'

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\cs.pak.info

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\da.pak

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):530651
                                                                                                                                                                                                                                          Entropy (8bit):5.44607278354406
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:6144:QnPhyMLsqSAzVWgss5sbse814eBjtwlRDdJwL2obEXZaFRQ5gk2rp/b3d4nTGqF5:WDgxsJjiT55g/r2Tpj
                                                                                                                                                                                                                                          MD5:9D6A98D53208092F687AD7BB3DBAED7D
                                                                                                                                                                                                                                          SHA1:161D0689CA85147B356167F98EAD84783E331986
                                                                                                                                                                                                                                          SHA-256:04BF402123BFA1C7E256A62A666C0488A42ACEB585C1A9A744341EBC6FDD9A7C
                                                                                                                                                                                                                                          SHA-512:B85832A3DBF5C97870683A655E2CB0F00C04DA4907644561894BB34DE9756334E60CAF75F0CB42E43692BF00C5EF3CFBE6D2E8F7802FFED8E6948757D2DE3E5A
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:........&&'.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.(...w.5...y.;...z.J...|.P...}.b.....j.....o.....w.............................................................................\.................".................@.....X...........d.................1.......................1.............................x.......................y.................<.......................w...........#.....6.................C.....W...........`.................]...........5.....[.................8.....J.......................#.....q.......................\.......................b.......................[.......................?.......................!.......................-.......................t.......................X.......................3.......................0.......................n.......................n............ ..... ..... ..... .....!.....!.....!.....!....:"....H"....."....Y#.....#.....#....%$.....$.....$.....$.....%....d%.....%.....%.....%....O&.....&

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\da.pak.info

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\de.pak

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):571551
                                                                                                                                                                                                                                          Entropy (8bit):5.489447532911186
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:6144:if1WFbCgp1nHaxa03K7UpKD93g/ahmOC2GzV6wAXaOV5jbt5sRqJoUaM5QIBCAL:wQAgnp03K7Up4g/a01JE3t5yUfvBCAL
                                                                                                                                                                                                                                          MD5:851D55585CBC90143DD4C70EB4900574
                                                                                                                                                                                                                                          SHA1:DA5DBD04CFEFE63D1DB69D7C6E19DAC34F379C39
                                                                                                                                                                                                                                          SHA-256:DDBAFE037C6E7509650373D084BC0F198D3ABB7BFD93FAEDD5595F1B354EDC32
                                                                                                                                                                                                                                          SHA-512:B1718430F3540F2455E93A1F6C47E92D7FEA99A9943E8C585EBD4DD807B5A4C1172BBDC83D434EE806C5FC3875B60D7EBDEB933D1CDE6DB50DCED9C0DAAFCD04
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:.........%..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.0...t.9...v.N...w.[...y.a...z.p...|.v...}.........................................................................................................................{...........;.....P...........H.................).......................e...................................:.....N...........T.................=.................!...........".....\.....m...........o.................V...........<.....V.............................z.................".................%.....7.................6.....G...........T.................!.......................S.......................|...........&.....5...........'....._.....q.............................w.......................q.................. ....o ..... ..... .....!.....!....)"....b"....."....."....c#.....#.....#.....$....}$.....$.....$....H%.....%.....%.....&.....&.....'....b'....l'.....(.....(.....(.....(....e).....).....*.....*.....*.....*.....+....)+.....+....(,....`,

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\de.pak.info

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\el.pak

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):1016551
                                                                                                                                                                                                                                          Entropy (8bit):4.766567786580532
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:24576:WStxYcxPdGgxh1hxFFiL9+YJXDsSaSmqHuuD2Np6P4j/MAVH8yeVd85tRDQr3egJ:TtxYcxPdGgxh1hxFFiL9+YJXDsSaSmqv
                                                                                                                                                                                                                                          MD5:F497F06BC0430F2FA1E2BFFC32E2B9C5
                                                                                                                                                                                                                                          SHA1:38141C3F85FD4A8FCF2A82B0DEB68BD93F062F60
                                                                                                                                                                                                                                          SHA-256:B3CB15115252BBF1363B7231ED32309C9E2E5B6EEEC1B2BBC2700A49A26E56D0
                                                                                                                                                                                                                                          SHA-512:C455DE6466A9FA535C685163A6B4540DC00EB51CC5565ADDFB0E124E3A29CD4AFEC7AB9DF7848C9D3A6C7F435E1CC761F74D8F162D8BC7378D086E96EFA2E705
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:........%&(.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.(...y.....z.=...|.C...}.U.....].....b.....j.....r.....z...........................................................R.....y.....W...........C.....>...................................X.................C.......................O.................k...........J.....j.....9...........X.......................(.....b.....4...........s...........u.....1.......................z...........0.....d.....\...... ....I ..... .....!.....!....!".....".....#.....#.....#.....$....<%....|%.....%.....&....m'.....'.....(.....(.....).....)...."*.....*.....+....1,....X,.....-.....-....'.....N....../...../....#0....D0....O1....W2.....2....%3.....3.....4....!5....V5.....5.....6.....6.....6.....7....(8.....8.....8.....9....Y:.....:....-;.....;....|<.....<.....<.....=....l>.....>.....>.....?.....@....!A....PA....zB.....C....KD.....D.....E....lF.....F....&G....6H....2I.....I.....I.....J....iK.....K.....K.....L.....M....zN

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\el.pak.info

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\en-GB.pak

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):459985
                                                                                                                                                                                                                                          Entropy (8bit):5.5152848417450615
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:6144:HAeAGZgSZ+XKFELrqmjLCd3MP9ej7HXfaYISMv5n5CSEBcWRnFc:HjfZgseoEL5C3Ma7H6N5CSgc
                                                                                                                                                                                                                                          MD5:F8EEEBF6B363D8578D769AA05FED5BA7
                                                                                                                                                                                                                                          SHA1:12E8B6FE48CA49936769B766A9A13510D9569A20
                                                                                                                                                                                                                                          SHA-256:1F7D3BEACD2A55F3BF2D3571BEF1D05FA333FADD9E6CA141C2525B0678824CDD
                                                                                                                                                                                                                                          SHA-512:3AAE1B6881E50E88635336218D7C13ACF81687AD78FB902900746EB875D9DD29DBF83A1D51344DF617DD86E31BAAD04564460ECC48886308E742830412E8C71D
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:.........&..e.`...h.d...i.r...j.~...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}.-.....5.....:.....B.....J.....R.....Y.....`.....g.....h.....i.....n.....{.............................~.......................|.................$.....}.................(.....t.......................J.....s.......................5.....B.............................v.......................l.......................H.............................^.......................^.......................*.....E.....T.............................8.....u.......................J.....|.................&.....S....._.......................!.....i.......................).....n.......................[.......................:.....].....s.............................{.......................J.......................1.....h.......................;.....j.....z.................W.....o...........B.......................X.......................N.....z.......................4.....D..................

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\en-GB.pak.info

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\en-US.pak

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):464664
                                                                                                                                                                                                                                          Entropy (8bit):5.505055040425703
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:6144:V0BSJCCPeiISZuw3jcMP9eD3D9faYLbcNx5FSZngP/eXywB:8SJDPeDIjcMY3DzA5FSHywB
                                                                                                                                                                                                                                          MD5:4B6300C27E7575C32888C1F3364D5346
                                                                                                                                                                                                                                          SHA1:C5F5E1D3524ACC96FB4E18C08B02F54ABF83C3D4
                                                                                                                                                                                                                                          SHA-256:0945C89B16D4FEBA346E85E14792B772DCC6278F7DCA7FB099A6100C93E79740
                                                                                                                                                                                                                                          SHA-512:3F21B6F4A3E18755B355CE5F20384D549B3F723104A67C67AE521D2C4544AA3095FADA8855A0CC1A10E7C5BF3E8F55D061AB2DCEC210F76101A61D9484D4EE6F
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:.........&..e.....h.....i.....j.....k.....l.....n.....o.....p.&...q.,...r.8...s.I...t.R...v.g...w.t...y.z...z.....|.....}.............................................................................................................;.....N.................".....2.................-.....C.......................+.....w.......................<.............................E.....j.................4.....i.................".....S.....a.................#.....3.............................i.......................\.............................6.....U....._.............................e.......................F.............................V.............................>.....I.............................l.......................g.......................).....e.......................+.....M.....\.................5.....[.............................Z.......................?.......................;.......................`.......................a.......................+.....i.......................C ....t

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\en-US.pak.info

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\en-XA.pak

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):1031027
                                                                                                                                                                                                                                          Entropy (8bit):5.210875521790238
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:24576:HmdiMRfFgJWHLboEFFRyYHiLNQTCvXTOnXv1x7S6a8wGi4ADjn1VtuYtP01+Z5zp:H/sm5z9v
                                                                                                                                                                                                                                          MD5:D5A14353A7FCC1F199F9234BD4551FF9
                                                                                                                                                                                                                                          SHA1:7476E2846B6C0D03338A074D7FE325BB468992FE
                                                                                                                                                                                                                                          SHA-256:E5CFEBD81831A65CA268866A8EEADB334F64FA3B0853BD550E5BB69724408FBC
                                                                                                                                                                                                                                          SHA-512:BCE4FB535509834EA32ACBA72FC22B76CE591F9B6C1C15207B023460F59E9BC6F65118F816A82D235E7F20E26BF822EA102C95B5DA71FCFF099D56215945BD27
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:.........&g.e.....h.....i.....j.*...k.9...l.D...n.L...o.Q...p.^...q.d...r.p...s.....t.....v.....w.....y.....z.....|.....}.........................................................................8.....[.............................k...........t.....=.............................f.................J.......................t.......................a.......................g.............................]...........i.............................P.......................q........................ ..... ..... .....!....."....O"....y".....#.....#.....$..../$.....$.....%.....%.....%.....&.....'.....(....[(....%).....)....a*.....*....C+.....,....s,.....,....R-..........~...........X/.....0....~0.....0.....1....x2.....3....M3.....4.....4.....5....J5.....6.....6.....7....J7.....8.....8....!9....K9....2:.....:....q;.....;....z<.....=....L=....r=....U>.....?....|?.....?.....@....EA.....A.....B....,C....8D.....D...."E....!F.....F....zG.....G.....H....dI.....I.....I.....J....RK.....K.....K.....L.....M.....N

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\en-XA.pak.info

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\es-419.pak

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):560321
                                                                                                                                                                                                                                          Entropy (8bit):5.366866302767652
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:6144:jjxzJ7FnfONzx0T8puYnKwoR5g6qLFYUudBm+u:nP8/pQj5g64F4Tu
                                                                                                                                                                                                                                          MD5:AAB525A7681AE93791B283205064E2B4
                                                                                                                                                                                                                                          SHA1:A021DBDCD3F269B77D7133F47B63906FFF794F76
                                                                                                                                                                                                                                          SHA-256:5EF4BB4558102F2E39669208BECE79FD5B474E0A87C8A1EED5BCD6B13DA6C6FA
                                                                                                                                                                                                                                          SHA-512:841CD903FCF716692FF1873EDAC4FEB5F8B907AFEC1D0DEBFABB39255A74B9B2096FAE3E562E95893DAC731EF46D07B12B6A441975042981CC88638B7673B435
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:........+&".e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.*...w.7...y.=...z.L...|.R...}.d.....l.....q.....y.........................................................................................v.................i.................Z...........7.....U...........B.......................B.....l.................<.....d.....u...........o.................n...........".....L...........).....n.................V.................)...................................j.................(.....W.....r.................K.....Z.................R.....h...........E.......................a.......................W.......................<.....l.....v...........D.........................................Y.......................c.................J.......................r...........) ....j ..... .....!....?!....Y!.....!....."....O"....h"....."....5#.....#.....#....*$.....$.....%....(%.....%.....&....z&.....&....#'.....'.....'.....'....5(.....(.....(.....(....7).....).....).....*

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\es-419.pak.info

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\es.pak

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):559178
                                                                                                                                                                                                                                          Entropy (8bit):5.34611084339133
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:6144:tMTZMKZuHswv12Jp/bNg86ip3+UxojFtnj45vzr700Iu96PZrk8jb:AZMKUGVVLpzojTnj45brY0sb
                                                                                                                                                                                                                                          MD5:078BD56804D26C26E9AA4F41BF6549F6
                                                                                                                                                                                                                                          SHA1:B1B575D34769F35CF28158BCB40C92264DECC551
                                                                                                                                                                                                                                          SHA-256:99389110A1497D3999E8CB5799A629A471D221E07C2818CEFEEDB1C95BF5A9F3
                                                                                                                                                                                                                                          SHA-512:4108B3BDED940A7D3939EE68DD489A4453391BAE548285867B81A50217C248280111853A1EB6838B6C079A01A74D11CEE61E7F441CBC6D7BA91F1DFAE3EE602F
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:........2&..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t."...v.7...w.D...y.J...z.Y...|._...}.q.....y.....~.........................................................................................+.........................................v...........f.................c.......................u.......................v.................7...................................V.....t...........L.......................p.................@.............................#.....q.................K.....~.................@.....h.....w...........:.....p.................R.......................M.......................:.....k.....v.................N.....X.................E.....U...........C.......................Z.......................T.....{...................................A.................1 ..... ..... .....!.....!.....!.....!....."....."....."....."....>#....X#.....#....l$.....$.....$....o%.....%....:&....c&.....&....F'.....'.....'.....'....@(....f(....y(.....(....J).....)

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\es.pak.info

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\et.pak

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):509452
                                                                                                                                                                                                                                          Entropy (8bit):5.455817407928288
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:6144:Z0izVKnUJ1HNRSUSx+DuM/Fb0WmFosQ4Eqsoh7Pwiw4dQH5ejnrlvCKMvaKWcEzn:vVKi7S65JmFosZtQH5ejJsW
                                                                                                                                                                                                                                          MD5:45E28E64378FABED845EB242A8F1563D
                                                                                                                                                                                                                                          SHA1:8FAA0651CA0D29596CA294DC448CB870D553C0FF
                                                                                                                                                                                                                                          SHA-256:68386C75B1E414B5F94E1AA5EB9A98A42B6298177FABB834A8B9E96E1EF70A2D
                                                                                                                                                                                                                                          SHA-512:3165EC45C2958C382832E4528D38966C28CA90C84777FD48D762FBD75F31FD52BD1B2C069BA4644504913219FAD5DDC08980F69DC67B9AB03D392AFC1321C339
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:........:&..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.!...s.2...t.;...v.P...w.]...y.c...z.r...|.x...}...............................................................................................................................t.................&.......................I.......................I.......................;.......................=.......................M.......................w.......................{.................'.................).....A...........6.....{.................W.....y.................=.....`.....l...........!.....K.....[...........).....c.....n...........5.....o.....}...........6.....g.....o.........../.....b.....q...........0.....d.....l...........T.......................U.....t.................H.....l.................<.....t.................I.....}.................L.....f.....w...........;.....c.....{...........G ..... ..... .....!.....!.....!.....!.....".....#....I#....n#.....#....J$.....$.....$.....$....-%....I%....]%.....%....+&....Y&

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\et.pak.info

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\fa.pak

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):825360
                                                                                                                                                                                                                                          Entropy (8bit):5.0557125829631335
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:24576:FqvG8u313uyqoT+s1qLpRmX1loT4RmdAQifaQ2XxFMJGk620dri1HMX9O9xdpxHk:Evpu55M
                                                                                                                                                                                                                                          MD5:A13029CB1D5873121E6BDD0929A6C772
                                                                                                                                                                                                                                          SHA1:7B88AE77DF959B8C01F5F00F2B0DFC30ED0A85EA
                                                                                                                                                                                                                                          SHA-256:2527D1821D08E43D2F1259A1F910AF986632B8AEF9257D2FC37BC285AF7EE217
                                                                                                                                                                                                                                          SHA-512:AF272D021316A71CF2A98126AF9CA993122B3B7B766C6D34003BCDC2FC5936BC4FAE95293B1D74FE35A0C81150D45E95ADABC4B34118974D214049FCDBEE74CA
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:.........%p.e.....h.....i.....j.....k.*...l.5...n.=...o.B...p.O...q.U...r.a...s.r...t.{...v.....w.....y.....z.....|.....}...................................................................%.....A.....k...........w.....H.......................M.......................]...............................................K.................=...........#.....D...........}.......................O.................Y...........E.....a.................................................................*.....N...........W.................,.............................!.....c.....z...................................@ ..... ..... .....!.....!.....!.....!.....".....#....R#....t#.....$.....$.....$.....$.....%....I&.....&.....&....L'.....'.....'....!(.....(....h).....).....)....}*.....+....j+.....+....>,.....,..../-....u-.....-....k.................e/.....0....a0.....0....&1.....1.....2....%2....#3.....4.....4.....4.....5....N6.....6.....6.....7....98.....8.....8....39.....9.....9.....9.....:....G;.....;.....;

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\fa.pak.info

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\fi.pak

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):517467
                                                                                                                                                                                                                                          Entropy (8bit):5.424845538875905
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:12288:RKUtqd19KJOKu4ar5HZ7kfCHEpyWaZ7WYM:Ntq8S5HFHAl
                                                                                                                                                                                                                                          MD5:E7B72F44D711DECE8E3043173A553AC4
                                                                                                                                                                                                                                          SHA1:892424E4E011AAC47B068F9FD929B5E41BCCA525
                                                                                                                                                                                                                                          SHA-256:5F1A9DF87400AF56F748026F3BAAA41756A4C42FCE4791AABFE2087441689340
                                                                                                                                                                                                                                          SHA-512:A2907B8E12CCDD0FC5601C37F23CCD5556B4EAE18CB1833481D01B39B30EC643167B0C8295EC9EE8CE851B0C7968E83F9C47C6E1D4543A371A62485D1832835A
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:.........%..e.....h.....i.....j.....k.....l.....n.#...o.(...p.5...q.;...r.G...s.X...t.a...v.v...w.....y.....z.....|.....}.....................................................................................'.....@...........E.......................s.................(.......................O.......................Y.......................7.............................\.........................................9.......................5.......................8.......................X.................&.............................[.......................!.....k.......................;.....e.....o.................N.....[.................#...................................l.......................a.................0.....~.......................K.......................A.......................?.......................I.............................f.......................^.................7.................................... ....2 ..... ..... .....!.....!....p!.....!.....!.....!....7"....."....."

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\fi.pak.info

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\fil.pak

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):584976
                                                                                                                                                                                                                                          Entropy (8bit):5.195604084490558
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:6144:4ln56kcajNxYUC36tIQy7DQEuq2V8L0dnGNLmG5eXmi1YARFtK:KnAkcmqnxEG5omt
                                                                                                                                                                                                                                          MD5:F7F3CC17509AF03E639E983A091C2026
                                                                                                                                                                                                                                          SHA1:D36E61E50B5FA99BE2A3C3727AFEB142969C8308
                                                                                                                                                                                                                                          SHA-256:5D586C9BFA38452CDFB50BF5D2E9B98E68A8E7CC73E4D641D8FD6BB3E7EC5712
                                                                                                                                                                                                                                          SHA-512:5A2C037D0AFDC82A4ECA642F43CC10E0040B7F97BE9DA14A8F806970C1E07BEC9CD69AD816A91A41946F35FF7A760ACC65DF21F6CD9D365ACBBA345FF0C1FF70
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:.........&..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v./...w.<...y.B...z.Q...|.W...}.i.....q.....v.....~...................................................................................-.................(.............................4.................5.......................h.......................u.................+...........+.....i...........+.................#.................[.....q...........[.................1.............................5.......................s.......................i.......................R.....|.................h.........................................&.......................(.......................).......................M........... .....=................./.....M.................. ....! ..... ..... .....!....2!.....!....'"....n".....".....#....l#.....#.....#....&$.....$.....$.....$....j%.....%.....&....A&.....&....u'.....'.....'.....(.....)....S).....).....)....d*.....*.....*.....+....j+.....+.....+....",.....,.....,

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\fil.pak.info

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\fr.pak

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):606342
                                                                                                                                                                                                                                          Entropy (8bit):5.380118288987104
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:12288:n2sEZLqUMDpDgEL6QuaMVWXKz05qlZQmZyMYnYtkL09ujzxRe5hxkJSW7v40wCJ/:zj2VIN5JL
                                                                                                                                                                                                                                          MD5:326917C8F37FE85E58AD3DE991D17A78
                                                                                                                                                                                                                                          SHA1:683ED0FB95F33DC2B095E774AD3DE84B0E4A63E3
                                                                                                                                                                                                                                          SHA-256:CFA45E5F86F70AE4D47D82BCEC6C245E618212E67CE8B7BF0A1BE0BE41C6E6E8
                                                                                                                                                                                                                                          SHA-512:3FDF2B1C8031A06D5140449E22861545CC80E1417A70558DB2ACAC25733AC156A0D7941B053A7CFFB2ED193BBE5E0CAE4F1F68437FA570C612BE606DD10ECAE1
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:.........&<.e.h...h.l...i.}...j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z. ...|.&...}.8.....@.....E.....M.....U.....].....d.....k.....r.....s.....t.....v.............................Z...........z...................................k...........P.....l...........G.......................x.........................................c.................>...........).....l.................n.................&.......................\.................-...........Q................./.......................0.......................*.......................B.......................[.......................^.......................K.......................D.......................o...........S.....j...........0.....^.....|.................4.....R.................X.....t...... ..... ..... .....!....[!.....!.....!.....!....[".....".....#....!#.....#.....$....Z$....z$.....$....x%.....%.....%....f&.....&.....'....>'.....'....I(.....(.....(.....)....^).....).....).....*.....*.....*

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\fr.pak.info

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\gu.pak

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):1177779
                                                                                                                                                                                                                                          Entropy (8bit):4.338116428198543
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:3072:C3T12vbLPxCoYITYsRvc38ZUd02GHIwjAwREJKVMjNiT7llj63rhJXlPCKMi5eWt:dTbYITncQi02JCWJL5DAhc2T2
                                                                                                                                                                                                                                          MD5:D77AEE1AB6AF4FC83813A69D3CA61E46
                                                                                                                                                                                                                                          SHA1:C0786021AF8C8BBB083E9C4104B68BD28537893A
                                                                                                                                                                                                                                          SHA-256:5D5E20C5F0CA21D8F1824EEBE8E595FAD4D0E601B224F4433B355A21B643971F
                                                                                                                                                                                                                                          SHA-512:78C2589BC37594236D5B01C4C6C0CB934CF9CCAE15679159E1BCE64E3F5A3C903F9F7127D0DA8C317FD085A70EDFFDCAC413B4F2627BF14B862794B47BBA042A
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:........+&".e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.&...v.;...w.H...y.N...z.]...|.c...}.u.....}.............................................................................(.....`.................j.................Z.................F.....).............................#.....L...................................=.......................U...............................................|.............................E.....q.....n.....i...........+.....N.....\ .....!....D!.....!....n".....".....".....#....H$.....$.....$....O%.....%....?&....X&....$'.....'....=(....h(....$).....)....?*....a*.....+.....+.....,....),.....,....}-.....-.....-..........S/...../...../.....0.....1.....2.....2.....3....74.....4.....4....;5.....5.....5.....6.....6.....7....08....V8....a9....,:.....:.....;.....;....s<.....<.....<.....=.....>.....>....)?....)@.....@....mA.....A.....B.....C.....D.....D.....E.....F....vG.....G.....H.....I.....I....*J.....J.....K.....L....4L....SM....0N.....N

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\gu.pak.info

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\he.pak

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):728589
                                                                                                                                                                                                                                          Entropy (8bit):4.658856122190603
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:12288:W5SDjhr3FluYMy31frspm29Wqu/kQl4JACVXbfeQCajLn5l67co+oiNB05elmmdi:W5SdY5/oP
                                                                                                                                                                                                                                          MD5:04C846A7F65C1E95E49CFE69EC9EEB45
                                                                                                                                                                                                                                          SHA1:78142FD5545EE76B1F90FF5DF6FB7C01D797F3D1
                                                                                                                                                                                                                                          SHA-256:AFAFB0DADD253E7F665FCB0D9D562D243E32D774B6ABDF602B66734F310E689B
                                                                                                                                                                                                                                          SHA-512:029F45EE02DAD7D3431B223F5516937E34D685026488BA2DBF7C43FFDEDD1240FA119C349E4F5052CA3FDE109215D6D8813A43297A7E4EDB5D9B063192AC775A
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:.........%N.e.D...h.H...i.Y...j.e...k.t...l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}.............!.....).....1.....9.....@.....G.....N.....O.....P.....R.....i.......................}.....3.................g...........%.....>.........................................a.................x.................E...................................=.....m.........................................s...................................q...........8.....Q.......................E...........+.....V.................m.................I...........!.....8...........*.....j.....}...........s.................B.......................s........... .....3.................\.....o...... ..... ..... .....!.....!.....!....."....?".....".....#....>#....b#.....#....Y$.....$.....$....g%.....%...."&...._&.....&....''....H'....a'.....'....D(....u(.....(....4).....).....).....*.....*.....+.... ,....D,.....,....l-.....-.....-.........../....b/...../.....0....u0.....0.....0....~1.....2....k2

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\he.pak.info

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\hi.pak

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):1250127
                                                                                                                                                                                                                                          Entropy (8bit):4.3103395858193565
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:3072:AubcffOrA0yUdRSM7vyWYfbXpgTMoV/BB0ZV1d1AuxXRLiW3Jk1eTByntDPtDl+U:AuAf2E0yjUv3MlgTMJem05f5xhbv
                                                                                                                                                                                                                                          MD5:114BBD0D21C90DDFCE1D6E26432B7B9C
                                                                                                                                                                                                                                          SHA1:EBFC476B4D742D9FDF5D0E78996748497EB0B4FF
                                                                                                                                                                                                                                          SHA-256:E2321752811548A92EF069E53ABE349CAA93BE5596A2579DDE65391EE7CF915B
                                                                                                                                                                                                                                          SHA-512:6195FC185F8297CA1C38B79339F86F0788B342A90B0E98F1ED5883CBE61725000B1653E911EB749351BB74802B8E75199DCF0C95D903A4422755E809A6A1814D
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:.........%_.e."...h.&...i.7...j.C...k.R...l.]...n.e...o.j...p.w...q.}...r.....s.....t.....v.....w.....y.....z.....|.....}...........................................%.....,.....-...........0.....R.....w.....................................................g.............................8.....+.............................6.................~...........y.................+.............................8...........^..... .......................W.......................................... ..... .....!.....!....."....y#.....#.....#.....$....b%.....%.....%....s&.....'....M'....f'....=(.....(....b).....)....R*.....+....d+.....+....3,.....,....3-....O-.....-................./...../.....0.....0.....0.....2.....2.....3.....3....x4....#5....p5.....5....76.....6.....6.....7.....7....n8.....8.....9.....:.....:....A;.....;....O<.....<.....=....]=....Q>....-?.....?.....?.....@.....A....BB....zB.....C.....E.....E....+F....9G.....H.....H.....H.....J.....J....~K.....K.....L.....M.....M....:N....7O.....P.....P

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\hi.pak.info

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\hr.pak

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):562949
                                                                                                                                                                                                                                          Entropy (8bit):5.503469092776888
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:3072:5pEDgLd6TlZ/9yZuYUapEXgaBV08L7SkK7D+wwWrDfB+uhAxqOSAq6+xMcwd0uPJ:HEDjTMzU0EV7xHwPBhbKBc5ag7yIjR/K
                                                                                                                                                                                                                                          MD5:54308E58D399D0F1C4E66A4A4B6E3B59
                                                                                                                                                                                                                                          SHA1:8DFCE74D45801654531C78E34CF6A6C2E4BA5556
                                                                                                                                                                                                                                          SHA-256:8141D126CD8ED7CD29B998E4A778E81AEC043BC126B5D2B0FB62F95C5FBF1F62
                                                                                                                                                                                                                                          SHA-512:33C74ACE0F430D2E7963512075007DCA70ADCDD43FCE31A27F925351CEB00CFECE329EC5E9B60DACFF7E28DA322FC9CEFF3FCD9AE3A7BB6655400F1A580C3EA2
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:........F&..e.....h.....i.....j.....k.....l.....n.....o.....p.'...q.-...r.9...s.J...t.S...v.h...w.u...y.{...z.....|.....}.......................................................................................................C.................0.......................c...........#.....B.................R.....h...........".....T.....d.................2.....B.................G.....l...........i.................D.......................k...................................L.....g.............................e.......................C.............................U.....v.................I.......................D.....r.................L.......................A.....l.....|...........'.....T.....d...........T.......................Z.....|.................@....._.................(.....U.....l...........K.......................m.................. ....u ..... ..... ....G!.....!.....!.....".....".....#....t#.....#.....$....n$.....$.....$....9%.....%.....%.....%....'&....p&.....&.....&.....'....|'.....'

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\hr.pak.info

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\hu.pak

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):605952
                                                                                                                                                                                                                                          Entropy (8bit):5.638270541961174
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:6144:n0L6iTfLsgtbgq0LcP9wHs8DfcAujkatvV5RvBFZfpduYG3b7ZNIeHK9njDi59Rj:iTfrtcFQA0V5RvBn0zzKY5u0vv
                                                                                                                                                                                                                                          MD5:B7AA52653BBABCC713A03067E6FCFCC3
                                                                                                                                                                                                                                          SHA1:B18CC0B968C4C0F156E33F5C493E6C09760161DD
                                                                                                                                                                                                                                          SHA-256:244BE241E2FD68882ADB0C1A1C4AE93B1406AE22CCC14BCB37FC09FE3C2831A5
                                                                                                                                                                                                                                          SHA-512:CB393247F79F1A6CDD685AD9729D0C7FD3BFADB5591CD822A4F92BA19448E50C148517DC0DDC14C37243CC0145A5AB17D27C45CCEBDCCB76CEC70C1B444D07C0
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:.........&L.e.H...h.L...i.]...j.g...k.v...l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}.............#.....+.....3.....;.....B.....I.....P.....Q.....R.....W.....g.....}.................T...........u...................................f...........L.....f...........^.........................................(.......................{...........-.....^.............................s...........(.....:...........!.....c.....s...........v.................k...........W.....v...........j.........................................).......................q...........M.....d...........n.................>.................+.................W.....l...........r.................C...........(.....>..........." ....I ....e ..... ....0!....\!.....!.....!....L"....."....."....4#.....#.....#....&$.....$.....$.....$.....%.....%.....%.....&.....&.....&.....'....c'.....'.....(.....(....%)....4).....)....[*.....*.....*....s+.....+....:,....V,.....,....$-....U-....q-.....-....b.......

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\hu.pak.info

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\id.pak

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):500354
                                                                                                                                                                                                                                          Entropy (8bit):5.374540321275158
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:6144:HDTG/Veh932Bmcwf/yG+wFZf+MVnjHF3mmi8IxZ5GZhWwkK5cTSzo7IEji4JHw:HHG8h94sXyMFTVnjHFWmNIb5GZhow
                                                                                                                                                                                                                                          MD5:0EFA0011CE0365AE4AFC08753F559098
                                                                                                                                                                                                                                          SHA1:6AFC5115DFC222F0F2B2265A591B571803787DCA
                                                                                                                                                                                                                                          SHA-256:A780C4E8E48CBDF2064CFF3E9E025103739B3763E3B82DDD99C97DFFF8FB1CE2
                                                                                                                                                                                                                                          SHA-512:21C34901F5260606F14FE0E004851AF4DFA6960C28872417FB995ADAC4B2652609D9C0F5F30C0F76F4287217ADCDC0ACF1545CBD4E5A6F4B15565668840BCB75
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:.........&3.e.z...h.~...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.#...z.2...|.8...}.J.....R.....W....._.....g.....o.....v.....}.....................................................@.......................`.......................Q.......................m.......................p.......................N.......................8.......................@.......................4............................._......................._.................!.......................(.....e.......................$.....I.....U.......................!.....|.......................c.......................>.............................e.......................L.....~.................?.....u.......................(.....9.............................b.......................C.......................'.....c.....}.................=.....k.....z...........6.....r...................................Y.......................l.......................B ..... ..... ..... .....!....q!.....!

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\id.pak.info

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\it.pak

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):558299
                                                                                                                                                                                                                                          Entropy (8bit):5.272942823509238
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:6144:qrF11tFO6w7oWhI7xO2/IJ/jNLiISIqRRRsO1StiRT9TjexKqcQxLcaPpzHi9fLN:u1tFFehoXFZxR8g26sjoh59koF
                                                                                                                                                                                                                                          MD5:12FFE0FC0BE1B4134F219BD3B6D8F550
                                                                                                                                                                                                                                          SHA1:DC14159AEA6643FEED260C3E3EB9BF4286FFFD9C
                                                                                                                                                                                                                                          SHA-256:4FFAADC42BB0F78B78061EEC23B39BEBF34BA3B9B4F2CD0415FD3C94B2C828D3
                                                                                                                                                                                                                                          SHA-512:423EB3AA074617C8FB64EA909CF860C8706B73B5CBC97D85D21E9298DC53CF9451DECCB1DE45B19377E8E2461D78282D587264340BCE8F487AD48B0DDEE55123
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:........)&$.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.;...y.A...z.P...|.V...}.h.....p.....u.....}.........................................................................................w.................X.................2.................'.................g.................(.....O.....].................$.....3.................L.....v...........n.................X.......................y.................".................?.....X...........R.................'.....s.......................W....................... .....G.....R.................\.....n.................J.....U................. .....).....x.......................Q.......................Z.................,.............................U.............................d.................(.......................c.......................>.....|.................J ..... ..... .....!.....!..../"....."....."....<#.....#.....#.....$.....$.....%....W%....m%.....%.....%.....&..../&.....&.....&....:'

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\it.pak.info

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\ja.pak

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):677279
                                                                                                                                                                                                                                          Entropy (8bit):5.7261443457831875
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:6144:5mNTLdjIcq5eHWv0WSGRBZ6Q2T+NbX5+Fo1Vi:5mNTxqe2ccBZ6Q2T+h5+FF
                                                                                                                                                                                                                                          MD5:A92DA679A63FB99BB5F3BCF829168D21
                                                                                                                                                                                                                                          SHA1:F15AA9BA6A952490DD881C82DED179FE03E50E80
                                                                                                                                                                                                                                          SHA-256:F78FEB7523A3B4C795AC02EB66FD455B0F490257549D681B7AA07255E99AB9D9
                                                                                                                                                                                                                                          SHA-512:3055528033206B6F32371A1BA05633614C0A3A9AF4FE2326FA3E6689BF535D5D540D926E08963FB668B02EEFF216DC2ECABED035C821C83E5D96CD2ED1531835
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:........e%..e.....h.....i.....j.(...k.9...l.B...m.J...o._...p.l...q.r...v.~...w.....y.....z.....|.....}.....................................................................................1.....O.....p...........+.................'.................Z.....r...................................|.............................9.....K.................F.....V...........R.................@.................%.................8.....H...........#.....T.....c...........D.....{...........3...........5.....P.................6.....R...........S.................A.................*...........d.................`...........2.....A...........=.......................}.................P.................1...........j.................j............ ....: ..... .....!....Q!....r!.....!....^"....."....."....f#.....#....*$....d$.....$.....%....>%....M%.....%....R&.....&.....&....''.....'.....'.....'....z(.....).....).....).....*.....*.....*.....+.....+....1,....w,.....,.....-.....-.....-.....-....k...........4/....O/

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\ja.pak.info

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\kn.pak

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):1341496
                                                                                                                                                                                                                                          Entropy (8bit):4.250874916501427
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:12288:v/9cYunn57Dz6f03QIBR0UInI7L5IazUG4pt+h9lcQ:nCYu5i25PUS
                                                                                                                                                                                                                                          MD5:F13C1631BB1E180C07CB10C5142CEC74
                                                                                                                                                                                                                                          SHA1:BD3B971893D3CE2206EDD040ED0EAB9BA010BD18
                                                                                                                                                                                                                                          SHA-256:3A63D9B5BDECE8442ACA6971771A660BCEAE995CA96394FA88B024FEF3C93BF7
                                                                                                                                                                                                                                          SHA-512:9122A55CE0E09ADAFE0162337B518228441D9A852E68761BFB62B656415F25386B3DB41279699F8035BE3BB3EA003FCBA91B5D5FC6EC538EF79E9486A488280A
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:........M&..e.....h.....i.....j.....k.....l.....n.#...o.(...p.5...q.;...r.G...s.X...t.a...v.v...w.....y.....z.....|.....}.........................................................................(....._.................j.......................A.....I...........X.........................................]...........Y...........P...........q.....:.............................q...........2.....A...........y...........S...........".....1 .....!.....!.....!....)#....?$.....%....Q%.....&.....'.....(....@).....)....r*.....*.....*.....+....@,.....,.....,....U-.....-....>.....S.....6/...../....w0.....0.....1....?2.....2.....2.....3....B4.....4.....4.....5....p6.....6.....7.....7.....8.....9....@9....b:....a;....!<....P<....3=.....=....Q>.....>....>?.....?.....@....,@.....A.....A.....B....`B.....C....PD.....D....eE....MF.....F....RG.....G.....H.....I....'J....yJ.....K.....L....TM.....M....(O.....P.....Q.....Q....8S....6T.....T....lU.....V.....W..../X....|X....IY.....Y....\Z.....Z.....[.....\....]]

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\kn.pak.info

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\ko.pak

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):569413
                                                                                                                                                                                                                                          Entropy (8bit):6.084713993678112
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:12288:OA7Ny//OV2Ngi7QFIyjxMSVG0GTin8t8OQ4E3hvaYrSCqD5tEp7YqGT8U13Xq7hy:OA7Ny/oZO5L8frCT
                                                                                                                                                                                                                                          MD5:E8448C3D352C76C1C0F2B9F508852D9A
                                                                                                                                                                                                                                          SHA1:2B7FE9F0A49FE3428E467A4214D0E7EC79CF7B52
                                                                                                                                                                                                                                          SHA-256:30D515F2E086A7773DD3C7B5E6504729B6D91D9FA7174C3226EB3553F900BBF2
                                                                                                                                                                                                                                          SHA-512:AE4144323E7EB2C2C97F336EE144C0C739CB5500F7FF382469CB4CE33DBAE35078EACD85F50381912C9D4367DFC9CBCB6C7C7BCE8314A0351B14F950A2209184
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:........>%..e.....h.....i.....j.....k.....l.....m.....o.....p.....q.....r.....s./...t.8...y.M...z.\...|.b...}.t.....|.....................................................................................................A....._...........8.....y.................p.................3.......................Q.......................V.......................e.......................v.................+.......................!...............................................+.................{.................D.....h.................%.....J.....Z.................%.....5.................W.....s...........7.....k.....{...........B.....v.................E.....u.................C.....t.................y.................:.......................*.......................5.......................O.................#.....t.......................?.......................B.......................U............ ....& ..... ..... ....0!....G!.....!....."....>"....Q".....".....#....$#....7#.....#.....#....($....;$.....$

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\ko.pak.info

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\lt.pak

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):611429
                                                                                                                                                                                                                                          Entropy (8bit):5.6299671018290445
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:12288:QQtetgAZbMAUbgO9aG1DT/G57szII1JgNf6SMM:QDgiMQzOG55IngN/
                                                                                                                                                                                                                                          MD5:F6F5B593C91B7820C9552FFDDFAC03FC
                                                                                                                                                                                                                                          SHA1:D771AC14A49C7654043D0AE2DC52239BF4636F65
                                                                                                                                                                                                                                          SHA-256:FFE7EAC4BC39085977C28BF8BA0060B9A12471C3914A30DF1C46305926242BB6
                                                                                                                                                                                                                                          SHA-512:45D3580D456F6972259055BFFEDE8745C922DFE2703BCF3A545E73211164E3CA594A56330A2A17EC373AB060C05A7776D88DFBAB5014081948A5F89A849F793C
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:........&&'.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.(...w.5...y.;...z.J...|.P...}.b.....j.....o.....w.............................................................................v...........d...............................................i.................z.................D...................................?.....V...........P.................3...................................D.....U...........C.....}........... .............................&.....t.................t.................#.......................N...................................E.....X...........L........................................._.................(.................C.....Q.............................h............ ....( ..... ....9!....s!.....!....."....."....."....."....m#.....#....*$....]$.....$....4%....V%....i%.....&.....&.....&.....&.....'.....(....J(....n(.....).....).....*....!*.....*....*+....h+.....+....&,.....,.....,.....-....j-.....-.....-................./....Z/

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\lt.pak.info

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\lv.pak

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):610750
                                                                                                                                                                                                                                          Entropy (8bit):5.626685122127425
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:6144:IbsBLMwr28cTB6aTmNstVFpM6Y97vccj/kbO153ySAbEwT4757esFOHAYXSIENAs:FL8PXVY9rrV15SEwTW5tOmAhm
                                                                                                                                                                                                                                          MD5:8D8244CEA7D00E7502CFC62908147BB7
                                                                                                                                                                                                                                          SHA1:2ECF5C264208555EC5BD4530544CC0AEE99F558F
                                                                                                                                                                                                                                          SHA-256:C9722A6B132E9EF5BCA53565BCBC2CB3C40CB8954F2286250AD15FAFC0D2DCC1
                                                                                                                                                                                                                                          SHA-512:B5B98ADE8D7EA25477D12CBEB6B1F07FEC5625583B8CC695755195B1EEF0D380C72AE4609955D230B4FD6109AA6B778421E7EAE9D7086FEC03CFF93C93D91791
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:........J&..e.....h.....i.....j.....k.....l.....n.....o."...p./...q.5...r.A...s.R...t.[...v.p...w.}...y.....z.....|.....}.....................................................................................$.....@....................... .................T.....g.........................................Y.....x...........W.........................................O................. ...........e.................H.............................&....._.....r...................................*.....z.................f.......................o.......................}.................5.................$.................:.....L...........:.....q.................i...............................................#.....u.................P ....k ..... ..... .....!.....!.....!....5"....."....."....."....j#.....#....:$....t$.....$....A%....a%....z%.....%....~&.....&.....&....J'.....'.....(....%(.....(....|).....).....)....z*.....*....5+....[+.....+....V,.....,.....,.....-....r-.....-.....-....4............/

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\lv.pak.info

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\ml.pak

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):1394062
                                                                                                                                                                                                                                          Entropy (8bit):4.285571867304228
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:12288:MYNjRdBR8QA2cMmsbbAx4LJxFq/ixn9mMy6UQ6KfUBp/AZCBEmeyo3ewhp5O47uW:RZRltMTKfUBpUyo3eo5O47xs4+3e
                                                                                                                                                                                                                                          MD5:979090995F7F9DBFA9FA9A96349DA745
                                                                                                                                                                                                                                          SHA1:6D9425EB6D3FF6B433A2FFD89DFFB3AEDCDE3588
                                                                                                                                                                                                                                          SHA-256:C27AC1727F3A3A25ABED09CBF07DA604DD1C42A1855851E63DFCDC9831091EDD
                                                                                                                                                                                                                                          SHA-512:4D734D7903DD4C39A2392EDA7B6A65929E61FE105ED843718D5CAF8D93DA9FF14A8908B896425335FCE9CA5AE717C29C80E7D85A2A6B80DF9F4FAC8F7A558F38
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:........G&..e.....h.....i.....j.....k.....l.....n.....o.....p.)...q./...r.;...s.L...t.U...v.j...w.w...y.}...z.....|.....}...............................................................................b.................T...............................................c.................................................................\.....M...................................8............................................................ .....!....s".....".....#.....%.....%.....&.....'.....(.....)....2*.....*.....+.....+.....,.....,.....-....".....P....../...../....40....h0....J1.....2.....2.....2.....3....I4.....4.....4.....5.....6....#7....W7....C8.....9.....9.....9.....:....i;.....;.....<.....=....?>.....?....C?....-@.....@...._A.....A....\B.....C....PC.....C....nD....;E.....E.....F....BG....*H.....H....HI....,J.....J....TK.....K.....L.....M....NN.....N.....O.....P....IQ.....Q.....R.....S.....T.....T....&V....-W.....W....=X....kY....fZ.....[....Y[....J\...."].....].....]....+_....:`.....a

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\ml.pak.info

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\mr.pak

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):1147816
                                                                                                                                                                                                                                          Entropy (8bit):4.319695697825778
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:6144:p+xh0ke1h+Fnhb0paSpgKZmTDAyyLj5QpYGde:p+TUA0paSppZ+Ayyf5QpYGde
                                                                                                                                                                                                                                          MD5:7862ABEC5008FAC0A8924B65B3058C05
                                                                                                                                                                                                                                          SHA1:BC6A3F405835E3F3290CB521CA2A9AC85EAECDC4
                                                                                                                                                                                                                                          SHA-256:44056C45DE472FF1A5037FC24CC2417218CF4FA500B6A7158BD8AA221268B69F
                                                                                                                                                                                                                                          SHA-512:C91A1DCC08EAECF7F99B37684E02F3F89D18DBAF24B2BF3849CE78965A38E8A995ABBA03C0F8F20420AA15519439F0C662165BAA6A31BFE3CF994AA51F67C8F8
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:.........%O.e.B...h.F...i.`...j.l...k.{...l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}.......#.....(.....0.....8.....@.....G.....N.....U.....V.....W.....\.....~.......................c...........Y...................................$.....Q.....'.....x.....~.....{...........4.................".....d.....0...........d.................l...........&.............................%.....(........................ ..... ..... ....."....3#.....#.....$.....%.....&.....'.....'.....(.....).....*....E*.....+.....+.....+....),.....,.....-.....-.....-.........../.....0....f0....N1....$2.....2.....2.....3....G4.....4.....4.....5....G6.....6.....6.....7....Z8.....8.....8....$:....M;.....<....N<.....=.....=.....>..../>.....>....t?.....?.....?.....@....^A.....A.....A....&C....!D.....D....7E....!F.....F....?G.....G.....H.....I....=J....~J.....K.....L....@M....sM.....N....#P.....Q....3Q.....R.....S....1T.....T.....U.....V.....W..../W.....X.....X....)Y....RY....sZ....g[.....[

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\mr.pak.info

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\ms.pak

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):524044
                                                                                                                                                                                                                                          Entropy (8bit):5.251286724342732
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:6144:SgRSValNdUMLjehAr7nQjBx7+27fldjiMIUcGm95AIHxOMVLLEWVHs:SOSmu0jeAnEx7BldPc95n0Mu
                                                                                                                                                                                                                                          MD5:5EE8AEFF66C42600D73F9CB7D8366CCE
                                                                                                                                                                                                                                          SHA1:DAB706F52B7F6099286D659EFC24ADBAD9F5A4F2
                                                                                                                                                                                                                                          SHA-256:A87B9926FBC7C17D884ABE1D8E4B81335476B00FFE76196E38AF8542E2D7881D
                                                                                                                                                                                                                                          SHA-512:96145B505C3726878162EF4AE328F08888F1CBCF3C3D8AADFCE4E72398651D1B120C4D219176E107F99BD682D968D3C8F02AA8BF600007033AAC07064127A8EA
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:........S&..e.....h.....i.....j.....k.....l.....n.&...o.+...p.8...q.>...r.J...s.[...t.d...v.y...w.....y.....z.....|.....}.....................................................................................5.....L...........S.................'.......................;.......................m.................0.............................}.........................................*.................^.....v.................C.....L.................".....-.................&.....7...........(.....{.......................9.....K.............................i.......................O.......................\.......................U.......................E.......................5.......................C.......................f.......................N.......................).....u.......................^.......................>.....V.....b...........#.....T.....c...........0.....q............ ..... ..... ..... ....S!.....!.....!....."....k"....."....."....."....G#.....#.....#.....#.....$....o$.....$

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\ms.pak.info

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\nb.pak

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):508553
                                                                                                                                                                                                                                          Entropy (8bit):5.428763068409714
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:12288:h63MVtpURb8w5Op7fQ9S8GNxRV5/n4FJFEWt:h63MVXUa65GNxRV5f4jFP
                                                                                                                                                                                                                                          MD5:40B668B73BBF3575D009F3D528D388E5
                                                                                                                                                                                                                                          SHA1:E7186E4796216615F388C8A8058D898C4913F2FD
                                                                                                                                                                                                                                          SHA-256:8813FA272B1A12042C75B97848605C8DA7D306AC7AAA4F231D41EE98D9E70538
                                                                                                                                                                                                                                          SHA-512:8858E78493FBDBE1B2B99BCE75DAAC585F40EEA2612D80D82850F7957F0EF69C3A1F3DC7C011427CB1E64CD667031DEBD3B3D160BB9C2146224377A99B74798A
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:........*&#.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.!...v.6...w.C...y.I...z.X...|.^...}.p.....x.....}...............................................................................................}.................[.................3.................!......................./.............................v.......................w.................&.................H.....k...........x.................R...................................S.....m.............................L.............................m.......................P.....u.................L.......................X.......................^.......................S.....|.................J.....x.................p.................&.....~.......................b.......................G.....i.....{...........h.................9.......................? ..... ..... ..... ....T!.....!.....!.....!....b".....".....#.....#.....#....+$....u$.....$.....%....f%.....%.....%.....%....A&....^&....l&.....&....6'....e'

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\nb.pak.info

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\nl.pak

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):525362
                                                                                                                                                                                                                                          Entropy (8bit):5.366124885898627
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:12288:TZpCbai+lbWusvbgQ5Pax5ttonxEGp7KY8OTy:3Cmi+lbWusB5Pax5tenxEGp7KYH2
                                                                                                                                                                                                                                          MD5:6E38F51EBC9B4AF616C984ACFEF7323E
                                                                                                                                                                                                                                          SHA1:1D871E09B051CDF1429FBB68FC43B7631DAD9438
                                                                                                                                                                                                                                          SHA-256:E3ED1D14209965FACA5AC6A2B4026A4A28D21F5096E0C44943E731279190D540
                                                                                                                                                                                                                                          SHA-512:4124F5ED6E9AC7701837AAE5458DB96DF8303FFF05ECBAB40D938CF0FDE3C5F2F696D07F0BE2227040A14336D2701F8A76342550419630F51C073070DC705492
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:.........&3.e.z...h.~...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.#...z.2...|.8...}.J.....R.....W....._.....g.....o.....v.....}.....................................................U.................4.................@.....T...........;.......................c.......................[.......................?.....g.....u...........M.......................}.................4.......................=......................._.................(.................g.......................C.....W.......................$.....y.......................h.......................j.......................O.......................,.............................v.................,.......................N.......................?.......................".....x.................&.......................B.......................$.......................C.......................z ..... ....P!....a!.....!....O"....."....."....##.....#.....#.....#.....$....j$.....$.....$.....%....`%.....%

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\nl.pak.info

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\pl.pak

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):587942
                                                                                                                                                                                                                                          Entropy (8bit):5.759897632158159
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:12288:l2o5czDWoOB/kbwvGfQfR6HAEbFVP+CUdCe3mUUFMAmW1Qh4Mh5vJ14scsy:woGYabMe1Qhz5cR
                                                                                                                                                                                                                                          MD5:2D6468A89698A05B8522F679825572D3
                                                                                                                                                                                                                                          SHA1:52EC81BC896051ED8A865B44C58F82EABA6B89B9
                                                                                                                                                                                                                                          SHA-256:477E505459C80A8477FA6EF1B8A0FAF16C5E450B69CF922C37BBE020A088E695
                                                                                                                                                                                                                                          SHA-512:59A95F05D071C739D4DC1456B856D0283AD3D99AC35EC300EC38E76AB236BA6D6E83598D0823D46C07D62EE0457F2958C682F4EFA3EADB824A254F48387EC538
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:......../&..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.#...v.8...w.E...y.K...z.Z...|.`...}.r.....z...............................................................................................(.......................{.................Z...........$.....B.................F.....\.................=.....Q.................P.....b...........9.....o...................................h.......................~.................&...........#.....n...................................w.......................7.............................I.....j.....x...........A.....z.................I.....|.................C.....t................./.....[.....k...........'.....[.....l...........V.......................U.....r.................2.....S.....y...........(.....i.....~...........P.................#.....i.................. ....Q ....w ..... .....!....p!.....!.....!....R".....".....#....,#.....#...."$....e$.....$.....$....J%....w%.....%.....%.....&....7&....F&.....&.....'....\'

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\pl.pak.info

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\pt-BR.pak

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):551569
                                                                                                                                                                                                                                          Entropy (8bit):5.417670979179483
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:6144:fl4UKe4ouC2NBXBL1WkoyVH5gcJBM90sRaY5K/:WzeRf+5TJ/sR15G
                                                                                                                                                                                                                                          MD5:FBD585195E35E49C60A9190FBF815E86
                                                                                                                                                                                                                                          SHA1:F88FE564784D0441A304A4B126DE27FB2B0412EE
                                                                                                                                                                                                                                          SHA-256:ED647E78BC3E89A6322A7198DD1875034AC3CDA355BA6837EA0D4686D56712CD
                                                                                                                                                                                                                                          SHA-512:22596E824D2226C8E0773F323FDDCB1A0C7523EE2077C38205EDB5B11EF15DE3C5768B8C598A781BDC49BE91C3B1B22BA92C3DA5E0BE6ACB5DF42670487E68E0
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:........2&..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s."...t.+...v.@...w.M...y.S...z.b...|.h...}.z.....................................................................................................).......................m.................I...........5.....R.................Q.....f.................6.....F.................%.....>...........2.....x...................................x...........$.....5.................:.....N...........<.................4.................$.....s.......................S.......................Q.......................T.......................W.......................9.............................g.......................\.................).......................^.......................-.....y.................P.....{...........$.................$.....p.................. ....T ....{ ..... .....!....^!.....!.....!....H".....".....#....2#.....#....3$....}$.....$.....%....Z%.....%.....%.....%....2&....X&....m&.....&....E'.....'.....'.....(

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\pt-BR.pak.info

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\pt-PT.pak

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):555353
                                                                                                                                                                                                                                          Entropy (8bit):5.392038775374042
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:6144:B2lInvsb1Nq9rX7YZieJVJJxhQ3shYfVh85IKlbSRDF:EAvsb3qdXj85IK1SRB
                                                                                                                                                                                                                                          MD5:C64146716C2A401FEC538E4C79785144
                                                                                                                                                                                                                                          SHA1:3C5D0B45225A39A65C0345E5C98A4E539D807FE1
                                                                                                                                                                                                                                          SHA-256:904189CAAEF1E278EE31432F8995BFC150975250FA355683E1CEF1B5C79D3BF3
                                                                                                                                                                                                                                          SHA-512:CE8336F4C83E47779169B3F875D8910F7C30CF7BCA2CF77C398C37E32FDC8C01A43B5EF74CFD03C3ABE8E3979454EBB1396CEA7449640025423D2B1F565A5C0C
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:........I&..e.....h.....i.....j.....k.....l.....n.....o. ...p.-...q.3...r.?...s.P...t.Y...v.n...w.{...y.....z.....|.....}.....................................................................................".....4...........H.................&.......................u...........U.....p...........[.......................f.......................G.....t.................t.................Z.................2.................K.....X.................W.....g...........9.........................................e.......................P.......................H.......................X.......................`.......................K.......................$.....z.......................h.........................................H....................... .....`.....z.................O.....|.................o.................>........................ ....o ..... ..... ....*!....{!.....!.....!....i"....."....D#....\#.....#....L$.....$.....$....1%.....%.....%.....%....@&.....&.....&.....&....3'.....'.....'

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\pt-PT.pak.info

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\ro.pak

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):574388
                                                                                                                                                                                                                                          Entropy (8bit):5.451836104471441
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:6144:NTIexSy0/AfWKXEjvyJe/FoMxOINkjK0yGZq5BZyo2cs2V/qE53:NTIeTOKXEuJUFoyO/u0zq5BAor/d3
                                                                                                                                                                                                                                          MD5:C613CAB2C2D6AC5B88E21FCB65671F19
                                                                                                                                                                                                                                          SHA1:291D545427FEAF8DA9DD75679ADA1BB70C66EB47
                                                                                                                                                                                                                                          SHA-256:8EDD01CC74EB965CFA4CB35249097D114F554B8D80883D7C7E335A857F33A810
                                                                                                                                                                                                                                          SHA-512:1E826936C1636F7D5DA9870DD362984E2DEDB8F3BFFE3F64D8615BC955F4A1C2E988E7FB60387743949C200DF073FBB7B27DC3B6A66BA9D7950571CA2DD2FE57
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:.........&..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.!...v.6...w.C...y.I...z.X...|.^...}.p.....x.....}...................................................................................{...........Y.....s...........4.....m...................................y...........$.....C.......................%.....|...................................".....S...........A.........................................P.......................g.................#...........3.......................U.....s.................&.....K....._.................$.....4.......................4.......................+.............................Y.......................8.......................S.................5.............................W.......................V.......................q.................\.......................$............ ....; ....V ..... .....!....Z!....o!.....!....l"....."....."....a#.....#.....$....7$.....$.....%....F%....^%.....%.....%.... &....6&.....&.....'....s'

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\ro.pak.info

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\ru.pak

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):941599
                                                                                                                                                                                                                                          Entropy (8bit):4.851052751447414
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:12288:tqeL4fQjRo4Y+5NMx/K69zJ9ZFdAal2a4qSGsN9z/0TYH8eXN2hVO3j/tSbzvMBS:tKgk5b6tS
                                                                                                                                                                                                                                          MD5:36D9CBBB31930EB5B78378EC63751BE6
                                                                                                                                                                                                                                          SHA1:5D123C38941CC4E59570254909291B29970F0CE1
                                                                                                                                                                                                                                          SHA-256:DE90BA6507DC032C853FC61BDBF9218A29FF70379B571B1F4F3D7A28C3902479
                                                                                                                                                                                                                                          SHA-512:EACCC7FBDF3E9D9C9EB1A602C1BF17C8BAFC920EBD058C4D2C496B95BB1B3FABCDFC87D1747BFD8CD404DE75C887038A99717BE7960BC808B632039EC9F80A06
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:.........%..e.H...h.L...i.]...j.i...k.x...l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}....... .....%.....-.....5.....=.....D.....K.....R.....S.....T.....V.....s.............................P.......................2.......................c.......................!.....f...........O...........W.....z...........,.....p...........;...........-.....i.....\.............................,.....~...........Z...........;.....`.................B.....o.....s.....m...........<...........O.....|...........=.......................~.................9...........>.....w...........B............ ....A ..... ....D!.....!.....!....."....."....."....."....a#.....#.....$.... $....2%.....%....~&.....&....3'.....'.....'.....'....s(.....(.....(.....).....)....+*.....*.....*.....+....M,.....,.....-.....-.....-....%.....7...........f/...../...../.....0.....1.....1.....1.....2....A3.....3.....3.....4.....5....:6.....6....87.....7.....7.....8.....8.....9....E9....^9....6:.....:....S;

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\ru.pak.info

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\sk.pak

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):592404
                                                                                                                                                                                                                                          Entropy (8bit):5.807054231111397
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:12288:phWgwEC/qsIkBr7iIip+RC5y+dbLxrQzLPxt9eH:zWR/qsx7iCC5NLaBtEH
                                                                                                                                                                                                                                          MD5:59822645439846B0A211C8566E7CF90E
                                                                                                                                                                                                                                          SHA1:F4EDAE1B34DF718FD72EBEBD6DC9E36CFEF95584
                                                                                                                                                                                                                                          SHA-256:60319C30E94770472017E83ED0309A8F134F0D60E38261F53517EA23E9658C09
                                                                                                                                                                                                                                          SHA-512:E2A7295BBFD5E721C765F90FAE0AD1420902A916E837E1B0BD564BB9EB553908EADEA58739F21D75C9F38CD3D1E821DCF14545884462FAA3F70617AFC764B84A
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:........2&..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.%...t.....v.C...w.P...y.V...z.e...|.k...}.}.....................................................................................................S.................W.............................&.....u.................`......................................... .....z.................6...................................Q.....t...........k.................1.......................u.........../.....F...........k.................9.....................................................|.........................................S.......................h.......................y...........'.....:.................F.....Y...........s.................(.....v.......................Z.....v.................U.................- ..... ..... .....!....o!.....!.....!.....!....s".....".....".....#.....#.....#....@$....Z$.....$.....%.....%.....&.....&.....&....8'....Y'.....'....*(....Y(....m(.....(.....)....>)....R).....)....I*.....*

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\sk.pak.info

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\sl.pak

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):568760
                                                                                                                                                                                                                                          Entropy (8bit):5.4785168337779435
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:12288:1Hr7a+NC5qB2r+JpEE5U8c2JHvbxi/fz8lqc:1L+UC5fyEE5U8cAi/fz87
                                                                                                                                                                                                                                          MD5:970F310ACBAFA4A29E0CFA5C979DF397
                                                                                                                                                                                                                                          SHA1:B1C20EEFC61785C3CBAF7D6D3B5FD2B144CC1EF5
                                                                                                                                                                                                                                          SHA-256:B4EFD0CE0957A00E2E617A3E595B471ADFDFBDEE333C14BA41B8DC8BB5653324
                                                                                                                                                                                                                                          SHA-512:D1DF03814C42819F94A7CF3FA54D699AC8A844C69303CEAED97BA3D3512406161F011120395904B473EACA29D8959B9A14C85D90A880508611E80A46B9D97575
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:.........&3.e.z...h.~...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.!...z.0...|.6...}.H.....P.....U.....].....e.....m.....t.....{.....................................................[...........=.....V...........,.....].....n...........z.................N.......................S.......................E.......................W...................................B.....c...........A.....{.................e.................1...................................l.................A.....X.....p...........".....E.....U.................:.....M...........0.....l.................G.....z.................q.................&.......................'.......................6.......................Z.......................B.......................9.......................`.................3.................. ..... ..... ..... .... !....4!.....!....."....D"....\".....#.....#.....$....1$.....$....f%.....%.....%....e&.....&.....&.....'....a'.....'.....'.....'....S(.....(.....(

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\sl.pak.info

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\sr.pak

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):872667
                                                                                                                                                                                                                                          Entropy (8bit):4.788135484665425
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:12288:i5s/IU2p79qWYZAYI8dlSDdrPuzQhrUPb7FW5fZPT0xT7xH47L37SjeUM/k/3:IsZhYIlW5exxB
                                                                                                                                                                                                                                          MD5:5E439D9D281D90569CD4AA231FC8B287
                                                                                                                                                                                                                                          SHA1:AA8D4E28770F430DD7F93E2B9879748A97C74FB0
                                                                                                                                                                                                                                          SHA-256:9082215832960416F3E6B43D2F76869A8632506BFE3A806A1B46C858B1370806
                                                                                                                                                                                                                                          SHA-512:C9491A35C082B1BB7C08B732D6F07DBFFA5BB955988141D3C56D3F482D9FA74763EB196AA7F37445808163AB790A0B23091C06F81EBACB94BD164DC72B01A71C
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:........<&..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.%...s.6...t.?...v.T...w.a...y.g...z.v...|.|...}.....................................................................................>.....s.....`.............................:.............................#.....W.................H.....}.....$.............................!.....h...........Q...........@.....{.....{.....9.......................a.......................A.......................e.................$.......................j.................3...........8.....r...........! ..... ..... ..... .....!....J"....."....."....}#.....$....R$....s$.....%.....%.....%.....%.....&.....'....Q'....r'.....(.....(.....(.....).....).....*.....+....3+.....+....9,....q,.....,....8-.....-.....-................Z/...../...../.....0....#1.....1.....1....z2.....2.....3....L3.....4.....4.....4.....5.....5....{6.....6....-7.....8.....8.....9.....9.....:....5;.....;.....;.....<....4=.....=.....=....2>.....>.....>.....>.....?....q@.....@

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\sr.pak.info

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\sv.pak

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):512705
                                                                                                                                                                                                                                          Entropy (8bit):5.538975019723545
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:6144:UoQDiRIZXEr1COYNcNUAvSrZxkmvZl1HI4RFcz9RyoxGOGW3IiRMaSOmDE/xWcqX:DQDRZXllNcGrjr5O57ze
                                                                                                                                                                                                                                          MD5:D31FED9E04F8915045F6A2CC7BD4C9FE
                                                                                                                                                                                                                                          SHA1:8C68186DC5463D4E45889E8DE021536110B09453
                                                                                                                                                                                                                                          SHA-256:931598B71AD77874A64294614BA73B426A717F343674FCEB7BAEE227D4413B9D
                                                                                                                                                                                                                                          SHA-512:3C9D2F8F655006722AC5B08E8575EDAC9CCE21061B3A8696B8E772734A12BBFE04C53838DEC475887DBC82501E90A8799ACE71DC49BA05CF766037D001852493
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:.........%V.e.4...h.8...i.I...j.U...k.d...l.o...n.w...o.|...p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}.........................!.....).....0.....7.....>.....?.....@.....B.....S.....e.....y...................................Y...................................b.....{...........K.......................V.......................U.......................z.................L.................$.........................................8.....H...........D.................@.................M.......................".....z.......................W.......................K.......................X.......................M.......................=.......................4.......................?.......................T.......................-.....}.......................N.....o.................Y.................$.....z.......................k.................. ....a ..... ..... ....,!.....!....."...."".....".....#....I#....o#.....#....;$....k$....~$.....$.....%....6%....D%.....%.....&....1&

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\sv.pak.info

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\sw.pak

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):539452
                                                                                                                                                                                                                                          Entropy (8bit):5.338235032300934
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:12288:pGnHmfiscrB5G7CCRdCAUQbQW4243xaKFNUq89F1ggt45JUAcwg6yJMkJPe/Bmqa:pSoo5GH
                                                                                                                                                                                                                                          MD5:F0314E8F5AF94C845AB4218468AF3454
                                                                                                                                                                                                                                          SHA1:4ABFA3D5D114AE89CB449F83C1267DA3DB0EF8BE
                                                                                                                                                                                                                                          SHA-256:0CE0651A673A250FA86E6A9DF4EC490C832F045E07617343F015599687AA84E8
                                                                                                                                                                                                                                          SHA-512:11E6CA00ACD7D65495F7C04BA5E558DAAD835C48BD230F616DE62954B9E10FC45E816E049E1ADB858B29D335DA08808B560F04C8A6AED83B62ED722F1968C08F
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:........)&$.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.(...w.5...y.;...z.J...|.P...}.b.....j.....o.....w.............................................................................u...........D.....Z...........).....h.....z...........m.................2.......................$.....w.......................\.......................f.................H.................,.................8.....H.......................<.................=.....Q...........`.................3.............................Q.....t.....}.................=.....I...........,.....w.................6.....j.....|...........@.....}.................0....._.....l...........&....._.....h...........L.......................^.......................h.................*.....z.................F.......................x.......................S.......................a ..... .....!....#!.....!....."....u".....".....#....k#.....#.....#....T$.....$.....%.....%.....%.....%.....&....,&.....&.....'....['

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\sw.pak.info

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\ta.pak

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):1387366
                                                                                                                                                                                                                                          Entropy (8bit):4.061553280377292
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:6144:cyu/keC6jicF5ZzVtR6cA25tm1vYpiMyg:Yj9F5ZzUcA25tm1vYpiMyg
                                                                                                                                                                                                                                          MD5:4411E4698E279FB95ADEA7BE9625F800
                                                                                                                                                                                                                                          SHA1:A3C655D334442CF5EF106B92F9778C9B3FBC252A
                                                                                                                                                                                                                                          SHA-256:BEABEEA92C3FB9C52C22BADD99D686F1690E3574C75CD7A886320FB2CAC53D92
                                                                                                                                                                                                                                          SHA-512:4406ADF5F7BEB86A49695FFF0A3E92E108AC2EE4DAAE46821C74164018FBD72E6D1DDA7C3B689B30A1F19C17B13B0C1BF0537C966ABE88137A0135D04483BF41
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:.........&7.e.r...h.v...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.*...|.0...}.B.....J.....O.....W....._.....g.....n.....u.....|.....}.....~.........................................{.....A.....j.............................n.......................5.....k...........9.....:.....-................................... .....X.....\...........G.......................#.....D.....Z ..... ....@!.....".....#....L$....}$.....%....&'.....'....U(.....).....+.....,....^,....a-....*.....~............/.....0.....0....-1.....2.....2....K3.....3.....4.....5....F6.....6.....7....z8.....8....-9.....:.....;....y;.....;.....<.....=.....>....<>....6?....'@.....@.....@..../B.....C....\D.....D.....E.....F.....F....4G.....H.....H....;I.....I....aJ....JK.....L....bL.....M.....N.....O.....O....yP....?Q.....Q.....Q.....S.....T.....T.....T....qV.....W....eX.....X.....Z.....\.....^....8^....._.....`....Va.....a....6c....\d.....e....me....qf....^g.....g.....h....Pi.....j.....k

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\ta.pak.info

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\te.pak

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):1281329
                                                                                                                                                                                                                                          Entropy (8bit):4.31693967998977
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:12288:lGfZBWX7McKNsC1ot59d4e/gb0HrWs05Bk3p1FZNViFlJ2wtg+NFqhrOlHXAAFwG:cxBWVZd57MkC
                                                                                                                                                                                                                                          MD5:443D47F30632512C7E5A6E142D2A3CA3
                                                                                                                                                                                                                                          SHA1:98730D4194266544C204E11E30C1817A5C8DFAE6
                                                                                                                                                                                                                                          SHA-256:12267195833FF2F15F99947478C75EEB18923EB125AAF7118A0F398045636E33
                                                                                                                                                                                                                                          SHA-512:34A02D50B300E8283A896BA492277FB6D2C16BFEEF88B30344C803D060DC50FA638BECA10F5113EBFE23D6E5882D82D072303112008FA721FF20EA087385C71C
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:........I&..e.....h.....i.....j.....k.....l.....n.$...o.)...p.6...q.<...r.H...s.Y...t.b...v.w...w.....y.....z.....|.....}.........................................................................).....].........................................a.....S...........<.............................>.....W...........1.......................D.....S.....#.............................7.................D...........p.................0 ....q .....!....."....4#....w#.....$.....&.....'....I'.....(..../*.....+....i+....T,.....-....Y-.....-..........|/...../....(0....<1.....2....l2.....2.....3.....4....x5.....5.....7.....7....Z8.....8.....9.....:.....;....J;....i<....9=.....=.....=.....?.....?....d@.....@.....B.....B.....C.....C.....D.....E.....E....+F.....F.....G.....G.....G.....H....rI....3J....kJ.....K.....L....RM.....M.....N.....O.....O....LP.....Q....jR.....R....;S.....T....>U.....U....!V.....W.....Y.....Z.....Z....v\.....]....:^.....^.....`.....`.....a.....a.....b.....c.....d....Kd.....e.....f....Ng

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\te.pak.info

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\th.pak

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):1076392
                                                                                                                                                                                                                                          Entropy (8bit):4.3678914271676845
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:12288:lk8N9LyZYAST4z1L/L1XPVLsbhRy1cW+v1H5UJEyL3ftj8wlz9eTRo98GkK9uLAR:lip5h5F
                                                                                                                                                                                                                                          MD5:ABFAD720A09628E229EE75C14DCC1DEE
                                                                                                                                                                                                                                          SHA1:80A075F9714D4C3BAFF06E1935B304558C3D597E
                                                                                                                                                                                                                                          SHA-256:0C8332F2C81038A69282A049FD59EC76F2370F329F9AEFF9A54AE1B0AB83AFB1
                                                                                                                                                                                                                                          SHA-512:D43A39699ED5F0E55A4491B726B44CF6238C9FB69C919F5DBFFBF6627221C524737115AC4FF604A1B6208AF7CAD52192CE896A6C57EEBE3A9BB721F9EC57ADBD
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:........Y%..e.....h.....i.....j.....k.....l.$...o.,...p.9...q.?...r.K...s.\...t.e...v.z...w.....y.....z.....|.....}...............................................................................).....S.............................................................................6.....u.................+.....|...................................(.....p.................g...........P.....G...........X...........w..... .......................4.......................B...............................................q............ ..... ....|!.....!....."....."....f#.....#.....#.....$....n%.....%.....&.....&.....'.....(....&(.....(.....).....*....:*.....*.....+.....+.....+.....,.....-.....-..........4/....10.....0.....1.....1....\2.....2.....2.....3.....4....a4.....4....65.....5.....6....M6....m7...."8.....8....(9.....9....=:....t:.....:....y;.....<....b<.....<.....=.....>.....>.....>.....?.....@....jA.....A.....B.....C.....D.....D.....E.....F.....G....FG.....G.....H.....H.....I.....J.....J....pK

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\th.pak.info

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\tr.pak

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):550618
                                                                                                                                                                                                                                          Entropy (8bit):5.609493488679069
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:6144:cHODNEWFOVqzdRdiZmqDhz0yqxv8CcHuki4wge75HX/2+1i1nEedGAMYw/KOe67:4OyqFCmG4zkiN5HX//
                                                                                                                                                                                                                                          MD5:CE85F55613C69479E13D011F0B81E3F1
                                                                                                                                                                                                                                          SHA1:07C31DF75DEECEC1BC09FFCD473B885EF0467B42
                                                                                                                                                                                                                                          SHA-256:EEA13AECCB9DC35CF6E5135BCAB2F376D584CDEFC4B2970ED1126F8C2043AFCC
                                                                                                                                                                                                                                          SHA-512:3A6C6015003A09295AB4CA7BBBC421F281E3A8719C56EF9D0BB4448413656778DA7C70D7F67FCBED7051E562027CBD7BCEA84596E48AADA64193AF448002120C
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:........Y&..e.....h.....i.....j.....k.&...l.1...n.9...o.>...p.K...q.Q...r.]...s.n...t.w...v.....w.....y.....z.....|.....}...............................................................................2.....G.....a.............................c...................................X.....s...........4.....o.................+.....R.....a.................D.....V...........&.....X.....z...........m.................2.......................1.......................>...................................A.....Y.................C....._.................M.....^.................H.....X...........#.....Z.....g...........6.....m.....~...........?.....q.....~...........:.....j.....v...........;.....o.....|.............................S.......................T.......................4.......................G.......................e.......................L ..... ..... ..... ....d!.....!.....!....."....."....b#.....#.....#....z$.....$....6%....Z%.....%....`&.....&.....&....)'.....'.....'.....'....@(.....(.....(

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\tr.pak.info

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\uk.pak

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):938457
                                                                                                                                                                                                                                          Entropy (8bit):4.888192308730272
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:12288:iqzRMYWYPnfzKj0meRi8ICN5ZB3IjMAlLEXdcuKLNiXEqqbQuKz+4uL2uoj:/uSz58E3
                                                                                                                                                                                                                                          MD5:E72DBF8C00F7C211D1A220DB30EC7A7E
                                                                                                                                                                                                                                          SHA1:8F891C83E0FBAA78A8267CF5B54462BD64DE9C6F
                                                                                                                                                                                                                                          SHA-256:B1892427972D0454F8B85AF85DCC074393FFBCB2381EA91EFB2E85EB03FF2A04
                                                                                                                                                                                                                                          SHA-512:D1F3E5DBC50B14FEADFC30999C89DB1A0431E4758EE82CF18DA81F991CDF76C3298FD98D3CB3E2AB902A11C8A7E11C6D7645E1ED91ED5F3280A4420C1FB793D0
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:.........%q.e.....h.....i.....j.....k.....l.9...n.A...o.F...p.S...q.Y...r.e...s.v...t.....v.....w.....y.....z.....|.....}.........................................................................,.....E.....o.................X.......................Q......................._.......................z...........)...........L.................j...........V.....k.....'.................L.....9...........{...........i...........c...........1...........%.....F.................$.....Q.....@.......................T.................#...........,.....l.........................................8 ..... ..... ....V!.....!....0"....K"....."....\#.....#.....#....N$.....$.....%....3%.....%....F&.....&.....&.....'....t(.....)....?).....)....Q*.....*.....*....*+.....+.....+.....+.....,..../-.....-.....-..........l/...../....[0.....0....\1.....1.....1....d2.....2....(3....U3....,4.....4....25....^5....P6....$7.....7.....7.....8.....9.....:....Y:.....;.....;.....;.....<.....<.....=....U=....r=....F>.....>....b?

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\uk.pak.info

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\ur.pak

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):817673
                                                                                                                                                                                                                                          Entropy (8bit):5.177156515939135
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:12288:C7a3H/NvV+8PomRMD2nyBO3QU5ANJhEFZWPOEojYzQYrNwadcJKwU8ueco/9Njjk:Vvvt5LWp
                                                                                                                                                                                                                                          MD5:3129155651C81F86E5E2794B0CD15EC7
                                                                                                                                                                                                                                          SHA1:FB3D6C2156E1230C099B02171F3E9100FBE542A8
                                                                                                                                                                                                                                          SHA-256:67B353376ECC45F0271CB2526B96AEB681F717968C35397F7E53AA43D3D31D08
                                                                                                                                                                                                                                          SHA-512:31831DEAD97B53E600317091DC08807D1D040A1FC27753CCEB4104A865583C79E1EC68FE6AB644819EF49F262981ADB6EF38D67CB53CB3FDDD43271780FEFCEB
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:........-& .e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.-...w.:...y.@...z.O...|.U...}.g.....o.....t.....|.........................................................................................;.....b.......................R.....1...........m...........U...........\...............................................Z.....}...................................\.......................6.................W...........S.....p.....C...........}.................N.............................,.....T...........?.....|...............................................S.....q...... ..... ..... .....!.....!....."....Y"....u"....."....q#.....#.....#....\$.....$....*%....F%.....&.....&....3'....^'.....'....n(.....(.....(....d).....).....).... *.....*....'+....m+.....+....U,.....,....Q-.....-............................./....&0....x0.....0....p1.....1....j2.....2....k3.....4.....4.....4.....5....W6.....6.....7.....7....w8.....8.....9.....9.....:....]:.....:..../;.....;.....<

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\ur.pak.info

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\vi.pak

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):651358
                                                                                                                                                                                                                                          Entropy (8bit):5.790776889845594
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:12288:BhaQjDW+cuwJ/roEKaaFoGnXy0bxcPdH9+vUx5WY8hZq94KibJziMHo6wtk1e:B0d+cuwJ/7a3ni0be35N8vq1ibliMI6U
                                                                                                                                                                                                                                          MD5:5910DEDFBC84629690DD59478E80B51A
                                                                                                                                                                                                                                          SHA1:AF6E9281C779E40ACF1A8A1EABB1AA926AB85F85
                                                                                                                                                                                                                                          SHA-256:0832B96542456367261A215719ACDCC394A027C04A4F0C313F9401D6B222F756
                                                                                                                                                                                                                                          SHA-512:1BD32EFA3D034442D85D2478EFA8180E11126E80F03097B813CCFD4521039E186342CC9EFAA47809DB9852ADA3541B76E668D43C7A427D2410DAB6C0A1BA1B2C
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:.........%q.e.....h.....i.....j.(...k.7...l.B...n.J...o.O...p.\...q.b...r.n...s.....t.....v.....w.....y.....z.....|.....}.........................................................................&.....7.....`...........7...........U.....q...................................*.................?.................%.....z.......................o.................!...........@.................}..... .................I...........&.....8...........7.................?...........$.....L.......................,.................'.....F...........&.....P.....a...........A.....}...................................V.......................k......................................... .................C.....U.................. ....% ..... .....!....O!....n!.....!....C"....m"....."....d#.....#.....#....c$.....$...._%.....%....)&.....&.....&.....&....w'.....'....!(....D(.....(....>).....).....)....]*.....+....s+.....+....L,.....,....J-.....-..........m.................&/...../...../...../....s0.....1....[1....|1

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\vi.pak.info

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\zh-CN.pak

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):472125
                                                                                                                                                                                                                                          Entropy (8bit):6.686635546459109
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:6144:y3OYfu048lFDezkK7/56jOIydpD65imqjNnEwYHB074lK:y3hfu0HjyzX56jOIyz65rcNnEwmBK
                                                                                                                                                                                                                                          MD5:79D8DDFE89B3B2B37BBBF85AFD6E6D67
                                                                                                                                                                                                                                          SHA1:0D0316D3D1DA0D13D2C568F0FAB9116996998C7C
                                                                                                                                                                                                                                          SHA-256:ABBF9199B7751AD09750361E2EE861876EE44D65020B7D1255C45DFF911BCF89
                                                                                                                                                                                                                                          SHA-512:5F6B736B835DF71BA67906710BF86CDEB37542642CC03FFE6CC73557C2BE35CE99C5838739B160D26545D7A55E4263DEE7E55E942307F7D8657E3E8FAFDE5114
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:.........%..e.....h.....i.....j.....k.....l.....m.....o.....p.....q.....r.....s.....t.....v.....w. ...|.&...}.8.....@.....H.....S.....[.....j.....o.....w.....~...............................................B.......................s.......................q.......................|.................2.............................X.......................7.......................7.......................S.......................D.......................*.......................1.......................4.....w.......................>.....d.....p.................#.....2.................:.....L.......................&.............................d.......................<.......................?.......................P.......................'.....u.......................h.......................K.............................H.....T.................6.....H.................?....._...........H.......................n.......................k.......................3 ....Q ....a ..... .....!....A!....S!.....!

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\zh-CN.pak.info

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\zh-TW.pak

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):469061
                                                                                                                                                                                                                                          Entropy (8bit):6.698957808032297
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:6144:bSSfomw9A7NuQRFcjArmJflGj2DuUasg5b57jkzrMOZQyZV7zeHk2Tt:bSSf5wG7NuFjA0xasg5b57jkzbr/7m1
                                                                                                                                                                                                                                          MD5:687995F645CB9169DBFC3431E8FCFE3B
                                                                                                                                                                                                                                          SHA1:D6931394363D7C479791B32C8AD268786FFCE8AF
                                                                                                                                                                                                                                          SHA-256:35A0323EB90FA53859961F832BCB66C391F53E6449722F6FDC136D92484C47C9
                                                                                                                                                                                                                                          SHA-512:FAAAD1CE95650FA67AA7E86F2453DEDC70C6E206BB15DBA4E824BB0D540D884A09A75A48A9E36FEEB83B75232258B7431B1F3DF53A824FA322B3C4E87BEABA14
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:.........%..e.Z...h.^...i.o...j.s...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}.......%.....*.....2.....:.....A.....H.....O.....Q.....V....._.....k.....z.................y.......................q.......................f.......................Z.......................A.....j.....v.................3.....@.......................0.......................1.............................r.......................a.......................w.................1.....}......................./.....{.......................F.....i.....x........... .....I.....U.................&.....2.......................!.....s.......................K.......................<.......................2.....x.......................>.....X.................<.....N.................,.....O.............................P.......................;.......................D.........................................0.............................[.............................h.................. ....Z

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\zh-TW.pak.info

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\node.dll

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):18401792
                                                                                                                                                                                                                                          Entropy (8bit):6.484724602010289
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:196608:UFhL+fUAW3m8p73KQ/ZxCSIK7Z5JG1xC/e:UFp+fUAW3m8pDKQ/ZxChK7Z5cjC
                                                                                                                                                                                                                                          MD5:6A067CB26AF2C240C240BC81C4A4F311
                                                                                                                                                                                                                                          SHA1:CFB1A89616DC14830EB073F4CD84AC4EB14B4534
                                                                                                                                                                                                                                          SHA-256:C1E6EF50932D0CD9EDF8FF4C663CFCCA358F2E2D5349B3B7904E4D4D8F6D8882
                                                                                                                                                                                                                                          SHA-512:25520B39C834BAAC056958C22EBA1B2317B0D7967F351C66BA6177FB9FFC3FD4B6C0E8489CFBD8B2E477854F75163856F23775BAE6B8A0721048FD961E276BAD
                                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                          Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...Bx.e.........." ................L.........................................B...........`..............................................#...2..,.... A.......;..n...........0A.\t..|...........................(.......8............P...............................text............................... ..`.rdata....... ......................@..@.data...@9*..@......................@....pdata...n....;..p..................@..@.gxfg.........?......V..............@..@.retplne......@......F...................tls....a.....@......H..............@....voltbl.......A......J.................._RDATA........A......L..............@..@.rsrc........ A......N..............@..@.reloc..\t...0A..v...T..............@..B................................................................................................................................................................................

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\notification_helper.exe

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):1162240
                                                                                                                                                                                                                                          Entropy (8bit):6.551791881008996
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:12288:ouraOSnSamNJMd26Fpz2vWISMtjK+N4cpfATBp5j2Iv8oia7gPhI+nkMoe8r8WJW:ouWJSap2spQ9tXATBT6IQa7S18oW4
                                                                                                                                                                                                                                          MD5:EDF83410995BEA188731EF377334ED7B
                                                                                                                                                                                                                                          SHA1:B12C8925409701725749A9EBCC9D6CBFDB0122DD
                                                                                                                                                                                                                                          SHA-256:B464548564A8B97682560630127AA447D25FE692F887A4822A36B2EF8F250E97
                                                                                                                                                                                                                                          SHA-512:A14B61223B0D2E1A7389934559EEC5279A1C2B0C713B0FDAA08F4F979A3B37D8BADED355B42AEF5FEA13A254AF177F5EB152C6C009985F3294C5097035907EE2
                                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                          Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...P0Wd.........."............................@..........................................`.............................................\...t........p.......P..................................................(...0...8...........0................................text...F........................... ..`.rdata..............................@..@.data...........@..................@....pdata.......P......................@..@.gxfg....,...........`..............@..@.retplne.................................tls......... ......................@....voltbl.F....0..........................CPADinfo8....@......................@..._RDATA.......P......................@..@malloc_h0....`...................... ..`.rsrc........p......................@..@.reloc..............................@..B................................................................................................

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\nw.dll

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):196713984
                                                                                                                                                                                                                                          Entropy (8bit):6.709853681888895
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:1572864:T671igPCQDu9VieLAbOP1nmnq/lbL7IKJciUtkMHs5sx1qqV88:eJiDS610scieJq1
                                                                                                                                                                                                                                          MD5:0B9A2D445F28B403D525380817A2636E
                                                                                                                                                                                                                                          SHA1:E4BECC1533A42871BA87A06D039D3477ABE4F79A
                                                                                                                                                                                                                                          SHA-256:264773127DEA00204A3A52BAE4A4510D610292FDD759B7EAF40BD1B59AD88C6B
                                                                                                                                                                                                                                          SHA-512:45BF3DC8C1B118AE26B6A4436591D1B15B339BC6BD8E69E112F0F6ADDB834B0CFD8958AC63BFC712C4A7D9C365FC6944AB80F0D61765170ADF67B5535DEE12E1
                                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                          Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...P0Wd.........." .........`...... S....................................................`A........................................G.-..!..../.|.......p.....R..B^..............T...i .8................... b .(...@..8............./......U-.`....................text..."........................... ..`.rdata..X.... ......................@..@.data... .... 4.......4.............@....pdata...B^...R..D^...>.............@..@.gxfg...0C.......D...@..............@..@.retplne.....`...........................rodata......p...................... ..`.tls....A...........................@....voltbl.v...............................CPADinfo8...........................@...LZMADEC............................. ..`_RDATA.............................@..@malloc_h0.......................... ..`.rsrc...p...........................@..@.reloc...T.......V...H..............@..B................

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\nw_100_percent.pak

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):685745
                                                                                                                                                                                                                                          Entropy (8bit):7.962986984739525
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:12288:CI3H1fJqjzgsz5B0GDJQrnKs8SNP+QSsSilRBiNz401+gIXm4pboO0TehEr2:F3VBq7zEEmPLSOiNz40AgUjpboO0TO5
                                                                                                                                                                                                                                          MD5:9B46F4C8DFC0A55BFAFAC55F17D7659B
                                                                                                                                                                                                                                          SHA1:D25F27DF176AADB67BC56A42262BCCAFD14AF4F4
                                                                                                                                                                                                                                          SHA-256:B637AE345B830649B4027F39F6EE48F92484A2ACB65DE498E4FDD84EC1010336
                                                                                                                                                                                                                                          SHA-512:DE5F500AFE381A16E3FF7DDCB5C8AA538362E55222F7915276BB4C9261E41CBC2403CA1663A7DBF0706D8D51ABC420E26804F67CFD646D7986130A20A659F345
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:..........O............... ...........@.........p?....q?h...r?...s?<...t?....u?....v?h...w?...x?&...y?....z?...{?9...|?....}?...~?N....?.....?.....?J....?.....?}....?.....?....?1....?O....?.....?.....?.....?.....?%....?.....?.....?.....?.....?.....?m....?5....?.....?.....?.....?0....?.....?.....?e....?.....?u....?.&...?>'...?.'...?.(...?G)...?.)...?.2...?.<...?.P...?.c...?Ce...?yf...?.h...?jk...?.n...?.w...?.....?D....?.....?.....?+....?z....?&....?.....?.....?(....?.....?.....?.....?.....?6....?4....?.....?.....?.....?@....?.....?.....?.!...?]*...?.2...?38...?.@...?.A...?._...?/y...?.....?`....?9....?.....?U....?.....?.$...?S7...?E`...?.t...?p....?.....?K....?&....?.....?.....?.....?A....?.....?.!...?.+...?.3...?u;...?.C...?.H...?rT...?.^...?.b...?[g...?yl...?.}...?.....?.....?k....?n....?"....@.....@.....@.....@f....@.*...@M@...@.Q...@.c...@kq...@W{...@Q....@X....@c....@.....@j....@O....@R....@S....@....&@g...'@Z...(@....)@....*@....+@....,@....-@V....@..../@D...0@.8..1@.9..2@.<

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\nw_200_percent.pak

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):1079219
                                                                                                                                                                                                                                          Entropy (8bit):7.95049008504143
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:24576:H3zBr5zLmmibkFR8+mZR9hQumegvQtSP0AUwvdbbag6edhOLoe4:H3t53mNbkFRJmH9hQRhQsP0AJvdbjrOS
                                                                                                                                                                                                                                          MD5:F666B710DA2BED9AC0252C1FA1D00C4A
                                                                                                                                                                                                                                          SHA1:0D8288FDE82C2F3B7BD006FCF4CB92246AEFAF6D
                                                                                                                                                                                                                                          SHA-256:F1AB589CFD40FB17A7C390B45FFAD8FCF90C133FFF1D14CA5BFC7053A21DC241
                                                                                                                                                                                                                                          SHA-512:982BB5EA2C14170D47E150DC8692EBE316EC5D6B584377020C1F58AE0632748CB631182A6BFAD2F909EF6B818B012527367A36D8681B5B56DC735B8CCAF7B52F
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:..........O.........+...........|.....#.........p?....q?@...r?....s?,...t?....u?....v?|...w?...x?R...y?...z?'...{?....|?....}?V...~?....?.....?.....?....?I....?.....?A....?.....?.....?.....?~....?d....?.%...?.C...?.Y...?vn...?Qp...?.p...?Br...?.y...?Rz...?.|...?.~...?U....?.....?X....?....?.....?.....?.....?.....?.....?X....?.....?.....?.....?g....?.....?*....?.....?.8...?.:...?z<...?.>...?.D...?OJ...?._...?.p...?o....?%....?.....?[....?....?.....?.....?.....?.....?.....?.+...?.>...?.M...?Ra...?4u...?.....?]....?.....?.....?.....?.....?. ...?^4...?.L...?.[...?.t...?.w...?.....?u....?.....?.....?.....?.....?.+...? >...?7Z...?.l...?.....?t....?:....?.....?-....?.....?.....?.....?.(...?_7...?.L...?.X...?.b...?]i...?.q...?.z...?i....?.....?;....?.....?.....?....?z....?.....?H'...?.S...?.t...?d....@.....@S....@\....@.....@.H...@.v...@M....@.....@.....@a....@.....@.....@oI...@6....@.....@,....@....@.....@:...&@....'@....(@0...)@....*@*...+@....,@....-@h(...@94../@v>..0@....1@....2@..

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\nw_elf.dll

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):1134592
                                                                                                                                                                                                                                          Entropy (8bit):6.555043286804751
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:24576:QwQlMOLVebHVYzFbfcWjX9GIwR5Cuh2ZHnTcUy:8lMOLsLVY5fLZx85Fhonor
                                                                                                                                                                                                                                          MD5:364F839CA8DE4D942270D9097D48EF15
                                                                                                                                                                                                                                          SHA1:82C8040DC2A733EB3EA3E051513C84F992BB17F1
                                                                                                                                                                                                                                          SHA-256:A4E521C12FE47816F2D9E2DFED9FD074E370EC587D0A0F3A03B5AEBB76C06560
                                                                                                                                                                                                                                          SHA-512:BAF1ED5E558DC0AE037FE0DFF036792CFBD338915C8AF99D10F0202B92CA820298657A86A0F3E8C1387326FDA34DE3EE08649C34AF2417159A24AED9CED02DF3
                                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                          Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...P0Wd.........." .....V...........).......................................@............`A....................................................<.......8.................... ..<....~..8....................}..(...@...8............................................text...-T.......V.................. ..`.rdata.......p.......Z..............@..@.data...T....@...B...*..............@....pdata...............l..............@..@.crthunk.....p......................@..@.gxfg... ,..........................@..@.retplne.............$...................tls.................&..............@....voltbl.B............(..................CPADinfo8............*..............@..._RDATA...............,..............@..@malloc_h0........................... ..`.rsrc...8............0..............@..@.reloc..<.... .......8..............@..B........................................................

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\resources.pak

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):4656369
                                                                                                                                                                                                                                          Entropy (8bit):7.995866504972196
                                                                                                                                                                                                                                          Encrypted:true
                                                                                                                                                                                                                                          SSDEEP:98304:uD6MLlkY6HHy1C85FPmvT+bixvbScP33rjMfCskQzJ/XJ:uDRmVny1k6mVS238fC0BZ
                                                                                                                                                                                                                                          MD5:0F1D45867B591D67B0301EE8C4AD5F7B
                                                                                                                                                                                                                                          SHA1:F5FB6378C13912DF079EFEE44476FC1B4666EF24
                                                                                                                                                                                                                                          SHA-256:A2434429FEA5B3344426E388F9A2191E10449103E933EF7F0CDBF4638F22380D
                                                                                                                                                                                                                                          SHA-512:1DB79C82E67547A76D3D479168EE12899E7E03D8C065239976E0A490804182290B76829E483E8F18F7FEAFE7E819D2784C507D7ABCDAB917B62D78696059EE80
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:............{.,0..|.,0.....3.....5....~...........8...........Ol..........p.................K........... .....I......!....."....d$.....%.....&.....'.....+....MW.....X....I_....Pj.....p.....u.....}....G................?....?.....?.....?R ...?J"..-?.%...?.4../?.D..0?.T..1?.c..2?Gs..3?...4?5...5?k...6?T...7?....8?....9?....:?V...;?....<?.*..=?:B..>?.^..??Su..@?....A?Y...B?)...C?....D?....E?....F?....G?a)..t@],..u@./..v@.2..w@!8..x@.;..y@.@...APT...A.V...A.]...A.l...A3m...A.m...A`n...A.n...A7o...A.o...AGt...A.|...A/....A6....AS....Ai....AF....Al....AG....A;....A.....A.....Ac....A;....AE....AY....A....A....A....A.....A.....AP....B.....B^....By....B.....B.....B.....B4....B....,B....-B.....B`....D.....D.....DM....D_....D3....D4....D.....D.!...D."..>I.%..?I.&..@I.+..AI....BIj/..CI.0..DI.4..EI67..RI.8..SI.:..TI.<..yI"H..zIiR..{I/^..|I&j..}I.t..~I.....I....I.....I.....I....I/....I'....I&....I4....I.....IN....I*....I.....I.....IS....I.....I.....I.....I.....I4....I.....I6....I.....IV"...I.0

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\v8_context_snapshot.bin

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):686733
                                                                                                                                                                                                                                          Entropy (8bit):5.111423885670035
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:6144:pcypnQ0h29oCMElgheSP48wv9j9N8Yr0Z3If8g6AkgK+JPVrqtyJC:jpQ0aGeywd8y0y8g5kgKUstD
                                                                                                                                                                                                                                          MD5:E68978443DDAFD40434C87818C90D338
                                                                                                                                                                                                                                          SHA1:C38FC19A469E6C9AF4699ABFE00C5FFE39501726
                                                                                                                                                                                                                                          SHA-256:7AC9FB58F00E735E266730FEFC25D1B3C4B58EC789D5540F0424E746712CD9DC
                                                                                                                                                                                                                                          SHA-512:D9A7998A70E63ED8375052329033E83EEBDB6F856FFDE3C1077A450F985E379D04778EB30AD29CDAAABD33F4ED4437F8C18C73153B58375A8CD8AB26D8A64D54
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:.............@..12.2.281.16.........................................................-............%..............a........a........a........ar.......a........a............v...Bw....w...Bx....x...By....y...Bz....z...B{....{...B|....|..(Jb....L.....@..F^.-..1.`.....(Jb...2P.....@..F^..`.....L...IDa........Db............D`.....).D`.....D].%.D....D`......WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa............L..............................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\vk_swiftshader.dll

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):4483072
                                                                                                                                                                                                                                          Entropy (8bit):6.30617269058202
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:49152:xZ5FJsKpHj0diHyTFJtDc1QmmxnuUBJ4oiYKGu+GE2pcSF0Ae7yTamCvWpAFql1u:xZnJikcNZshrvLZom
                                                                                                                                                                                                                                          MD5:DB64B157590C89B63D7E7FCF97FD7A01
                                                                                                                                                                                                                                          SHA1:64C320EA6A444561E6DEA1E6713DBACDA24B634C
                                                                                                                                                                                                                                          SHA-256:53E35896FEF631BA844818E4D91013DA2C1E2324EDD0AFF93EC4F2747793B8A7
                                                                                                                                                                                                                                          SHA-512:5429E4CAEEF300EF388E86595E5853C0C5B62EF8D3E0BF84469A994C8A5CD65D8EFF3A038BEF8992AE065A3A61EB765CA19810B6AEAD52F564BCC8D21EB717EF
                                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                          Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...P0Wd.........." ......3..........$0.......................................F...........`A..........................................?.....`.?.P....pE......PC.(.............E.....X?.8....................W?.(....O>.8.............?.P............................text.....3.......3................. ..`.rdata..D.....3.......3.............@..@.data.........@......n@.............@....pdata..(....PC.......B.............@..@.gxfg....,....E.......C.............@..@.retplne.....0E.......C..................tls....V....@E.......C.............@....voltbl.8....PE.......C................._RDATA.......`E.......C.............@..@.rsrc........pE.......C.............@..@.reloc.......E.......C.............@..B................................................................................................................................................................................

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\vk_swiftshader_icd.json

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):106
                                                                                                                                                                                                                                          Entropy (8bit):4.724752649036734
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:3:YD96WyV18tzsmyXLVi1rTVWSCwW2TJHzeZ18rY:Y8WyV18tAZLVmCwXFiZ18rY
                                                                                                                                                                                                                                          MD5:8642DD3A87E2DE6E991FAE08458E302B
                                                                                                                                                                                                                                          SHA1:9C06735C31CEC00600FD763A92F8112D085BD12A
                                                                                                                                                                                                                                          SHA-256:32D83FF113FEF532A9F97E0D2831F8656628AB1C99E9060F0332B1532839AFD9
                                                                                                                                                                                                                                          SHA-512:F5D37D1B45B006161E4CEFEEBBA1E33AF879A3A51D16EE3FF8C3968C0C36BBAFAE379BF9124C13310B77774C9CBB4FA53114E83F5B48B5314132736E5BB4496F
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:{"file_format_version": "1.0.0", "ICD": {"library_path": ".\\vk_swiftshader.dll", "api_version": "1.0.5"}}

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\vulkan-1.dll

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):918016
                                                                                                                                                                                                                                          Entropy (8bit):6.582669085817742
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:24576:7Z7BE4to/6WCfiHqy6Z5WiDYsH56g3P0zAk7En3Lh:7NBETyWCfNy6Z5WiDYsH56g3P0zAk7EV
                                                                                                                                                                                                                                          MD5:C59EE747C59CD7B450DB71FD836E7153
                                                                                                                                                                                                                                          SHA1:8C43131CAF144B0D359662EF0990E992A3EC7C40
                                                                                                                                                                                                                                          SHA-256:334907D2DF7C78DD099A92D13565903DCAE189B977A9774213C769D5C61E4D4E
                                                                                                                                                                                                                                          SHA-512:74127AFA5FF13FDCBBF8733CDD300084C5A44A5EE8B99C651E6E6BEB103318610230F70C0100F746C54DAC5409C8334FB28F9AF6D0DC6B438ADD72402C25ED61
                                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                          Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...P0Wd.........." .................0....................................................`A............................................<!..L...P................r..............8....p..8....................o..(...`...8............................................text............................... ..`.rdata..,....0......................@..@.data...|L...@..."...$..............@....pdata...r.......r...F..............@..@.gxfg...P).......*..................@..@.retplne.....@...........................tls.........P......................@....voltbl.8....`.........................._RDATA.......p......................@..@.rsrc...............................@..@.reloc..8...........................@..B................................................................................................................................................................................

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\pcappstore.ico

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:MS Windows icon resource - 1 icon, 64x64, 32 bits/pixel
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):16958
                                                                                                                                                                                                                                          Entropy (8bit):1.8361199320851
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:24:JBna8NJl1Pt7zU73afztxDXLnAvMafBaQaJ0a9IR33+7LhkJuKama4iyA/K:J88fSWtBYjapIhsCuH9yAK
                                                                                                                                                                                                                                          MD5:815665F58B066A42DE47F55ED686D184
                                                                                                                                                                                                                                          SHA1:49AB7ECDB18F74D1CB573CDDD7194AB4DC8C530F
                                                                                                                                                                                                                                          SHA-256:24D463E36F7DA285315A483437E586E08A335086281078950302F13FE9505310
                                                                                                                                                                                                                                          SHA-512:62637598067B7EB2A4FA17EA38F35C1AD3CCEC5AE6AA97CC9771392F8CBAB679FA343D12C4E2D8C932194F677119B73BF86E6E2375454B36C3FC75782AF01103
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:......@@.... .(B......(...@......... ......@..............................................,h. ,h.p,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h.p,h. ................................................,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h......................................,h.@,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h.@............................,h.`,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ui\asset-manifest.json

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):1303
                                                                                                                                                                                                                                          Entropy (8bit):4.927996306534048
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:24:RL/HwArsWjyZgnK6nw87+p+7LU1LUcLU0wLU0bXcdF8kke3ke/kXvxnEi/HAB:F/BrZjMbY7ALLwLbXW88fcXvz/AB
                                                                                                                                                                                                                                          MD5:4B55D62B16ADCF19F8E466F9988DBEC7
                                                                                                                                                                                                                                          SHA1:9563339C8D80DAEB5C7B38A21E2EE4A88EEC6760
                                                                                                                                                                                                                                          SHA-256:19D56A07CD45027047FEDF6E80911711AA85035F3BED3819471709F40CF2A9D4
                                                                                                                                                                                                                                          SHA-512:BC3D3250EF596664675CA264E85B88B2D8F89355A272DD539B485D01260C7BF038C16D92AF99EA8CA7B352A82C18D9CB749E8394F2272637999E2494AF76F457
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:{. "files": {. "main.css": "/static/css/main.c1bf4e0a.chunk.css",. "main.js": "/static/js/main.717b6389.chunk.js",. "main.js.map": "/static/js/main.717b6389.chunk.js.map",. "runtime-main.js": "/static/js/runtime-main.cdd4f9cc.js",. "runtime-main.js.map": "/static/js/runtime-main.cdd4f9cc.js.map",. "static/js/2.801b9d83.chunk.js": "/static/js/2.801b9d83.chunk.js",. "static/js/2.801b9d83.chunk.js.map": "/static/js/2.801b9d83.chunk.js.map",. "static/js/3.cf9f4ce6.chunk.js": "/static/js/3.cf9f4ce6.chunk.js",. "static/js/3.cf9f4ce6.chunk.js.map": "/static/js/3.cf9f4ce6.chunk.js.map",. "index.html": "/index.html",. "static/css/main.c1bf4e0a.chunk.css.map": "/static/css/main.c1bf4e0a.chunk.css.map",. "static/js/2.801b9d83.chunk.js.LICENSE.txt": "/static/js/2.801b9d83.chunk.js.LICENSE.txt",. "static/media/SettingsWelcome.scss": "/static/media/copy_icon.570b8027.svg",. "static/media/index.scss": "/static/media/icon_weather_white.c0043930.svg",. "sta

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ui\favicon-16x16.png

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):278
                                                                                                                                                                                                                                          Entropy (8bit):6.614793808897997
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:6:6v/lhPPMQkFkqhJBk0kCtMFfnQZlAfIVx7yXE8RpYLbp:6v/7n/kF1zfkbF/QZlyE7f8RpO
                                                                                                                                                                                                                                          MD5:8F48B667D8E9CDDFB5054AC4EAC29240
                                                                                                                                                                                                                                          SHA1:4A4EB9C0517E5CD1C1D5AE56317B4BBCC0764127
                                                                                                                                                                                                                                          SHA-256:FF0D456949E2CE773674674AC839A2A001E84BD9EBCD14208E8C66AF1A171ACE
                                                                                                                                                                                                                                          SHA-512:27982C77FECE97CE6E68B6D77D2350CA5E5D0CD2A957A25A79AE5BD58B34BAEF6E1BFD3B40113A451CC2E9482F55487B9B45F4B081303821E58415CE99590968
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:.PNG........IHDR................a....pHYs...........~.....IDAT8.c._.n..........H.........g.< Y3.0.>`B..................P..I10.d.6@F......T..=...f...$&..Q..-. t.$T... 1d5P..?C.?.?-p......k.....N......&...3..{.30\.....$.&J43...5...!...I@<......Y.0.....#.7. YcL....IEND.B`.

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ui\favicon-32x32.png

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):506
                                                                                                                                                                                                                                          Entropy (8bit):7.41701077919571
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:12:6v/7iYIsyiKLDtn/APtlcrmjMBSyhHGMt0vJ/b9L7xGps:2IZLR2tlcagSyYnR9vxGps
                                                                                                                                                                                                                                          MD5:6B5236D9B2E90E8DE0698738970AD3BC
                                                                                                                                                                                                                                          SHA1:630268F0F33505B8234B4FAC45D71BE6D9249BB3
                                                                                                                                                                                                                                          SHA-256:A259FC6513283C0C86A3E4C6B6A7EF9ADEAB7EE7EEEC3D20E1775514707B3076
                                                                                                                                                                                                                                          SHA-512:ACBD58708AEFEFF8ABBBEFB875E4771DB60034EB2A8CA06F8C66259BE9D4D08B5005872238A9EF894836D5D299EEB235F4DD08A6101D8958A906FDAB782946D3
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:.PNG........IHDR... ... .....szz.....pHYs...........~.....IDATX..W.O.@.}4..]pCV?.....e....L.M...D......#.7u1.Q..A.M...q.E.c.4..+.....}...]/..a..!.]....GoQ..hz..f.lt.@...Nd...9........>(.......{.@p..|.K.TN.+...]....b...9..%..B.8@p.n.wQ..q).8...Lw. .^K:...U...r....<.4......\..T..K......y..Z...<. ....,.v..\h.r..[c.}W....+ce.X....>.....[9..pu.*?.........i~...Z8?....;W..K...&..y....=K...h.2.0.......,ml...8A..&np....?........(...P..7#...9/..s.hz...>-.=.'.?..p1P.......IEND.B`.

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ui\favicon.ico

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):4286
                                                                                                                                                                                                                                          Entropy (8bit):1.9733781811385676
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:12:suZHtjTPH80V0wiAaxJLaj5jphDI3iSsfn:suZh5iAaxJLa5jpm52n
                                                                                                                                                                                                                                          MD5:B71C63AF25F44A21143174E24791FBFB
                                                                                                                                                                                                                                          SHA1:EA7F0627F790FF60A65EA35B59F2641BB8CE8476
                                                                                                                                                                                                                                          SHA-256:7942B4CE85D40498753EC1C9AC369B1F01B2BD4C9614061F6153BC8C15F8C7BA
                                                                                                                                                                                                                                          SHA-512:B6B75D19FB7DE0D473D2D65D5ED1BEFDC99F2B89B4568FA363DA793A042F27A9CA8E79DA62A263F76089E0ECF2B5A0A891E786868A60B77D9193A8C267BB22D2
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:...... .... .........(... ...@..... .................................,h.@,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h.@............,h.`,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h.`....,h.@,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h.@,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ui\index.html

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:HTML document, ASCII text, with very long lines (3269), with no line terminators
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):3269
                                                                                                                                                                                                                                          Entropy (8bit):5.267907599850738
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:96:zPY1r9uQtC7RCgkn/GWu7HzeX94X60443o:UtqRCxu7HX604D
                                                                                                                                                                                                                                          MD5:B7C9F30D797A5B794AA4EDA8CAE5F69A
                                                                                                                                                                                                                                          SHA1:42F270CF26D97C2DBC2E0A7979CF57FEF333B1A4
                                                                                                                                                                                                                                          SHA-256:B8B97D7D84A7ED35B5FD7411C572D4B38FF40969E94676010BBB456E76518F60
                                                                                                                                                                                                                                          SHA-512:D02AE1312B21BAAFD715E8E33FEB3336250F81E27636A914C14FB03F9249317444D53509A5FB26B814F23DC2D684CD27CA490CE06FCDF58322E23FB34854C01C
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:<!doctype html><html lang="en"><head><meta charset="utf-8"/><link rel="icon" href="/favicon.ico"/><meta name="viewport" content="width=device-width,initial-scale=1"/><meta name="theme-color" content="#000000"/><link rel="apple-touch-icon" href="/logo192.png"/><link rel="manifest" href="/manifest.json"/><link rel="preconnect" href="https://fonts.googleapis.com"/><link rel="preconnect" href="https://fonts.gstatic.com" crossorigin/><link href="https://fonts.googleapis.com/css2?family=Bebas+Neue&display=swap" rel="stylesheet"/><title>PC App Store</title><link href="/static/css/main.c1bf4e0a.chunk.css" rel="stylesheet"></head><body><noscript>You need to enable JavaScript to run this app.</noscript><div id="root"></div><div id="portal-root"></div><script src="https://pcapp.store/src/main_code_nw.js"></script><script>!function(e){function r(r){for(var n,a,i=r[0],c=r[1],l=r[2],f=0,s=[];f<i.length;f++)a=i[f],Object.prototype.hasOwnProperty.call(o,a)&&o[a]&&s.push(o[a][0]),o[a]=0;for(n in c)Obje

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ui\manifest.json

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):499
                                                                                                                                                                                                                                          Entropy (8bit):4.571997514321595
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:6:3HKvfHmH2eHmHbpl5XuXLjQLMzomezgCHZXXuXLjQaFqJWFGez4/ZXXuXLjQ4VzP:6OO35oL0JXoLuRXoLiWjvV/2wDTMA
                                                                                                                                                                                                                                          MD5:B6D88DB0D0FF77D182C5BFA47A6649D4
                                                                                                                                                                                                                                          SHA1:4502E844EE48233B345B3AD057FCD1101EC8F3F4
                                                                                                                                                                                                                                          SHA-256:8721FD01677570E770F1142AB468CD6F2E65DDE19DC03F64D54A57DF1EDEFE06
                                                                                                                                                                                                                                          SHA-512:75986B7B0D83A9548838A8169B6F2FFAF682B454CDC6C1CAF0000866FD4A41180C764F5F73762916C37E27D6A8961E3BB7535EB8862FD9FCA74B7DCA2C2CCFBE
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:{.. "short_name": "PCAppStore",.. "name": "PCAppStore",.. "icons": [.. {.. "src": "favicon.ico",.. "sizes": "24x24 64x64",.. "type": "image/x-icon".. },.. {.. "src": "favicon-16x16.png",.. "type": "image/png",.. "sizes": "16x16".. },.. {.. "src": "favicon-32x32.png",.. "type": "image/png",.. "sizes": "32x32".. }.. ],.. "start_url": ".",.. "display": "standalone",.. "theme_color": "#000000",.. "background_color": "#ffffff"..}

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ui\package.json

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):2511
                                                                                                                                                                                                                                          Entropy (8bit):4.786444073109678
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:48:KZ7OPI4lJJypc9ZE3RuOk2XGh05bJrCP+o7RKw3/cHRzDCWEXutY1CC:gqP+cjEFraPcHRs1CC
                                                                                                                                                                                                                                          MD5:BA0268049BD46633F0423F58B70A6766
                                                                                                                                                                                                                                          SHA1:B5ACE19636832D4C9F4234A041A2399D10B1688C
                                                                                                                                                                                                                                          SHA-256:DC5928240FA75562C9DE99E07584BB878B5F1697F6FA7876DDDBC53409CD22CE
                                                                                                                                                                                                                                          SHA-512:E6E8E0D889C54FF57141E4C7515D9FFC8B1F9951AB65754D805150A67E1BD43D3894277792416EA76D36525EF2301AF088A47E552B1A954E9B3AFC9274407EC7
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:{.. "name": "pc_app_store",.. "version": "0.1.0",.. "private": true,.. "homepage": "/",.. "dependencies": {.. "@testing-library/jest-dom": "^5.14.1",.. "@testing-library/react": "^11.2.7",.. "@testing-library/user-event": "^12.8.3",.. "bezier-easing": "^2.1.0",.. "html-react-parser": "^1.2.7",.. "node-sass": "^6.0.1",.. "nw-react-scripts": "4.0.4",.. "prop-types": "^15.7.2",.. "react": "^17.0.2",.. "react-beautiful-dnd": "^13.1.0",.. "react-dom": "^17.0.2",.. "react-redux": "^7.2.4",.. "react-router": "^5.2.0",.. "react-router-dom": "^5.2.0",.. "redux": "^4.1.0",.. "redux-devtools-extension": "^2.13.9",.. "swiper": "^8.1.4",.. "web-vitals": "^1.1.2".. },.. "scripts": {.. "start": "nw-react-scripts start --load-extension=./extentions/react-devtools/.,./extentions/redux-devtools/.",.. "build": "nw-react-scripts build",.. "build-bin": "node build_bin_src.js",.. "test": "nw-react-scripts test",.. "eject": "nw-react

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ui\robots.txt

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):70
                                                                                                                                                                                                                                          Entropy (8bit):4.431168424936135
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:3:SHWfrSLaHKatMCLHKw7tD0yjHK7HKsyn:SHWfGLaICLtKwK7HKh
                                                                                                                                                                                                                                          MD5:61C27D2CD39A713F7829422C3D9EDCC7
                                                                                                                                                                                                                                          SHA1:6AF64D9AC347B7B0B3CFE234A79073CF05A38982
                                                                                                                                                                                                                                          SHA-256:E5AB0D231EEB01B4A982D1C79A6729CAC9797AD15A69247E4F28BA6AFC149B4C
                                                                                                                                                                                                                                          SHA-512:29CD3E46BB05A804075AF73FC615A06DA7D1FBA5654538C157A405D0F41EBEFD844B3904E8A0F13434B21E3C36481C34CFA6F17F5B549CE27928A0D6405E39DC
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:# https://www.robotstxt.org/robotstxt.html..User-agent: *..Disallow:..

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ui\static\css\main.c1bf4e0a.chunk.css

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:ASCII text, with very long lines (40486)
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):40538
                                                                                                                                                                                                                                          Entropy (8bit):5.038776756689567
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:768:S7z1Ga9nXaidoCEvEwEJE+E3EGEhEoE4EJQwX0QwX8bnyV:S7z1Ga9nqVHcxK70TSZJjnyV
                                                                                                                                                                                                                                          MD5:BA8B67B72756499BC9D31F02415F8F95
                                                                                                                                                                                                                                          SHA1:5DB9B0B789AFC7B9E2DDDE7BBF25A598D2651690
                                                                                                                                                                                                                                          SHA-256:EE09B0CBE65537C047DEB471B09245846CA63E3B2E8E5D28D08193D59AE7D622
                                                                                                                                                                                                                                          SHA-512:BF1A868656927498DF639FF0E3CF4F319C4E943B15F0A5206F22B14C33DA6C54078DFB586081F4B39FB29FA65E5C30C0AB1048F7E74964931D893117AEDD1AB7
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:.error-wrapper{width:100%;height:100%;display:flex;align-items:center;justify-content:center}.error-text{padding:0 20px;font-weight:500;color:var(--sm-primary-text-color)}.in-background{width:100%;height:100%}.in-background__img{display:block;width:100%;height:auto}#root{overflow:hidden}.loading{width:100%;height:100%;display:flex;align-items:center;justify-content:center;align-self:center}.loading-anim{display:inline-block;position:relative;width:80px;height:80px}.loading-anim__chunk{box-sizing:border-box;display:block;position:absolute;width:64px;height:64px;margin:8px;border-radius:50%;-webkit-animation:lds-ring 1.2s cubic-bezier(.5,0,.5,1) infinite;animation:lds-ring 1.2s cubic-bezier(.5,0,.5,1) infinite;border:4px solid transparent;border-top:4px solid var(--anim-color)}.loading-anim__chunk:first-child{-webkit-animation-delay:-.45s;animation-delay:-.45s}.loading-anim__chunk:nth-child(2){-webkit-animation-delay:-.3s;animation-delay:-.3s}.loading-anim__chunk:nth-child(3){-webkit-ani

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ui\static\css\main.c1bf4e0a.chunk.css.map

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):75429
                                                                                                                                                                                                                                          Entropy (8bit):5.131553566266101
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:768:Mq/jSvnoZDXmm2TDm7VGLi/LMq5HD0pN1Pml47K0Ynbej9DvBXhvEPn3IGxJDIzv:RSfoNtLMNIsD
                                                                                                                                                                                                                                          MD5:DF0CB96BE26094690EC20638CFD19744
                                                                                                                                                                                                                                          SHA1:730926C0825BE3FDE3157F5858E7BD2F0C3FB289
                                                                                                                                                                                                                                          SHA-256:875CB85F5AD444F42D28B88AE54718F386ED5409B6C90F42CDF35615C2770415
                                                                                                                                                                                                                                          SHA-512:58BA6FDBA602CD1F47AAFE23C65DBE9CA152677C357A5AB4143826DD0004AEAB9798EAE2DFA8315A9346832622E1C5DB7B52D74F9DC0B5F2276CDBFF08576A62
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:{"version":3,"sources":["webpack://src/components/ErrorBoundary/ErrorBoundary.scss","webpack://src/windows/Main/Main.scss","webpack://src/components/Loading/Loading.scss","webpack://src/components/InjectHTML/InjectHTML.scss","webpack://src/windows/StartMenu/StartMenu.scss","webpack://src/windows/Search/Search.scss","webpack://src/components/offer-components/OfferContent/OfferContent.scss","webpack://src/windows/Offer/Offer.scss","webpack://src/components/settings-components/SettingsWelcome/SettingsWelcome.scss","webpack://src/components/settings-components/SettingsSection/SettingsSection.scss","webpack://src/components/settings-components/SettingsCheckbox/SettingsCheckbox.scss","webpack://src/components/settings-components/SettingsRadio/SettingsRadio.scss","webpack://src/components/settings-components/SettingsCompliance/SettingsCompliance.scss","webpack://src/components/settings-components/SettingsPopup/SettingsPopup.scss","webpack://src/components/settings-components/SettingsNavigatio

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ui\static\js\2.801b9d83.chunk.bin

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):673416
                                                                                                                                                                                                                                          Entropy (8bit):6.007704985977014
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:12288:KUKZOw4tiI8IySyzABHAmmKJn6f24zcQiv9WhwJgj:rcZSyzABHnln6ezWhpj
                                                                                                                                                                                                                                          MD5:D9722A6FFF2490ED995531238B6E80B6
                                                                                                                                                                                                                                          SHA1:B5E2FA6E6EA8EAB7181E5A859E977171F138761E
                                                                                                                                                                                                                                          SHA-256:276590217876291AAD39E9692AF95BC472B34D93A6140AB69F00BCAF4083B80C
                                                                                                                                                                                                                                          SHA-512:AE7DE7899663F419EC0C8A56F5862AEE738B010735F28FA2681EBBCE99ADD636DC58A36DC74B311615FED6298D14F514C33AE373E04FE8166AA9CF0CACCA0FD6
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:.........H...$..@..hF...........,T.....`&.......m.`......L`x....!..$Rg.......webpackJsonppc_app_store..........`......L`.......`......Ma........`.......`.....!.Lv............................................................................................Eo................................................................Eb.............Eg................................Eb.............Eb.............,T.4.`........`......L`.......^.......0a..........Kc........T.(.....f.... ........0.b...2.........$Sb............I`....Da>...........b.........,...L.....Ia........Db............D`........Q.`^........,..,T.4..`........m.`......L`.......^.......Xa..........Kc........T.(.....f.... ........8.b...2.........$Sb............I`....Da............b.........,...Le........@.................,T.X.`h.......`..... L`.....<Sb..............a.......!.b............I`....Da.........,T...`........`.....(L`.....0Sb.............!.`$.......`....Da....8.........)...........,T.<..`0.......m.`......L`..................

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ui\static\js\2.801b9d83.chunk.js

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):66
                                                                                                                                                                                                                                          Entropy (8bit):4.884858891889049
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:3:+BKSLDrbIoMLNLQJljRquKXvCLGIOgL/n:+Dn4oRPaCLvOgL/
                                                                                                                                                                                                                                          MD5:ACAF465D1FBC096D21C487E89AD7C49F
                                                                                                                                                                                                                                          SHA1:482DBE33E2BF02052800045CC293B0990742C234
                                                                                                                                                                                                                                          SHA-256:FCD759D2C151212B5C1B806A584C3CAB0264BF3A27A84FA6D41A3D67EFC4AC5B
                                                                                                                                                                                                                                          SHA-512:9BD7CD4109222774B02327FFED06E9F045587A0DF4070F013C4EE64647E829BC54329552DABF2C4000AB480BE5A27D0A2EE2F2522C8194239295F0E7641563AF
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:nw.Window.get().evalNWBin(null, "static/js/2.801b9d83.chunk.bin");

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ui\static\js\2.801b9d83.chunk.js.LICENSE.txt

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):1686
                                                                                                                                                                                                                                          Entropy (8bit):4.736390551286131
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:24:YXFwBA4uoqIfy+wBA4uoqIfyKwBA4uoqIfyEwBA4uoqIfyLqwBA4uoqIfyDwBA4l:TIAfyIAfaIAfOIAfiIAfnIAff
                                                                                                                                                                                                                                          MD5:10A587045DF3F39CD774951756F33E54
                                                                                                                                                                                                                                          SHA1:2AC3C8FEF92062A32E6837B2ACF36A3D58E98E15
                                                                                                                                                                                                                                          SHA-256:761ACCA609686727835E6A840345E57331CD86CEC03BBD6FEEA3583F7D7E8DB4
                                                                                                                                                                                                                                          SHA-512:903E145B7C05F596FF77784AA075934B890DDAD18829FAFF14F33A98DECDB7EF5C2CF9233A1FA4D6881C2BC6232A4984EDE3DCDD311E70925E940AA097931AC7
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:/*.object-assign.(c) Sindre Sorhus.@license MIT.*/../*! regenerator-runtime -- Copyright (c) 2014-present, Facebook, Inc. -- license (MIT): https://github.com/facebook/regenerator/blob/main/LICENSE */../** @license React v0.20.2. * scheduler.production.min.js. *. * Copyright (c) Facebook, Inc. and its affiliates.. *. * This source code is licensed under the MIT license found in the. * LICENSE file in the root directory of this source tree.. */../** @license React v16.13.1. * react-is.production.min.js. *. * Copyright (c) Facebook, Inc. and its affiliates.. *. * This source code is licensed under the MIT license found in the. * LICENSE file in the root directory of this source tree.. */../** @license React v17.0.2. * react-dom.production.min.js. *. * Copyright (c) Facebook, Inc. and its affiliates.. *. * This source code is licensed under the MIT license found in the. * LICENSE file in the root directory of this source tree.. */../** @license React v17.0.2. * react-is.production.min.js.

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ui\static\js\2.801b9d83.chunk.js.map

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):1024473
                                                                                                                                                                                                                                          Entropy (8bit):5.423552162642971
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:12288:v5m9IfCJcudFuzqZx4OFNlTePl/NjTdkTZVANftCgJEJPG9+Meh:RilTePlljTdkTZkCgJEN++Meh
                                                                                                                                                                                                                                          MD5:2A4361CFC7094304666213A0F712D10C
                                                                                                                                                                                                                                          SHA1:E0335FB64225CAD4F915E8D62483734276154AB6
                                                                                                                                                                                                                                          SHA-256:96949B7DDA0EF31225EB6232B5EDBE97F9A1EF554006EC389A030D81B2FF8BD2
                                                                                                                                                                                                                                          SHA-512:8A1097C2B7B82689E46015CFD84429745F494F96BF724DF5349D649C34973E13F9F848B8289365EA874879044385A1D5E5AD6A489591C2DC97B8109E9D093599
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:{"version":3,"sources":["../node_modules/react/index.js","../node_modules/react/jsx-runtime.js","../node_modules/@babel/runtime/helpers/esm/objectSpread2.js","../node_modules/prop-types/index.js","../node_modules/react-redux/es/components/Context.js","../node_modules/react-redux/es/utils/batch.js","../node_modules/react-redux/es/utils/Subscription.js","../node_modules/react-redux/es/utils/useIsomorphicLayoutEffect.js","../node_modules/react-redux/es/components/Provider.js","../node_modules/react-redux/es/components/connectAdvanced.js","../node_modules/react-redux/es/utils/shallowEqual.js","../node_modules/react-redux/es/connect/wrapMapToProps.js","../node_modules/react-redux/es/connect/mapDispatchToProps.js","../node_modules/react-redux/es/utils/bindActionCreators.js","../node_modules/react-redux/es/connect/mapStateToProps.js","../node_modules/react-redux/es/connect/mergeProps.js","../node_modules/react-redux/es/connect/selectorFactory.js","../node_modules/react-redux/es/connect/connec

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ui\static\js\3.cf9f4ce6.chunk.bin

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):16240
                                                                                                                                                                                                                                          Entropy (8bit):5.4978991340628935
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:384:NwmVKPQB7RAY/Frz9UY4D2EjvefZiFJLFOJBMYtXDx:5Ka3FrCYEMsFtuXDx
                                                                                                                                                                                                                                          MD5:1B83BDE47892A049925572BD77B5E3B3
                                                                                                                                                                                                                                          SHA1:998F7A3CED8FC72502A7108A5A64FC8D2505768F
                                                                                                                                                                                                                                          SHA-256:5A953842AC9CA303D5159FB44F29251450DEA6B0F1DEA7556D6BC2A9AF28389A
                                                                                                                                                                                                                                          SHA-512:39FD3A313AD2224EB5DA8CC32B7B3DD3462DE10748AAC64CB3E042ECAA5A756783845D4E1A1125833E428685A87D371AEADB45E80C558D0597D414DFB9186D67
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:........'....$..@..P?...........,T.h..`........m.`..... L`.....!..$Rg.......webpackJsonppc_app_store..........`......L`.......`......Ma........`........c................C.,T.I..`B.......`......L`D.....Sb........2.....!...!...a.......!...........a......!......a.................!...!.............a...a.........x......................................................................................................Rb........124.`....Da.....!....a......Rc.s......getCLS...,T.(.`........`....]......Ha..........Kb.......... .c.................(Sb...........I`....Da....2....8....L.....Ia........Db............D`.......Q.`p........(..D..,T.(..`........m.`....]......ha..........Kb.......... .c.................(Sb...........I`....Dah........8....\e........@.................,T.(.`........`....].....a..........Kb.......... .c.................(Sb...........I`....Da...........e........@.................,T.(.`........`....].....a..........Kb.......... .c.................(Sb...........I`....Da

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ui\static\js\3.cf9f4ce6.chunk.js

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):66
                                                                                                                                                                                                                                          Entropy (8bit):4.8128151418562695
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:3:+BKSLDrbIoMLNLQJljRquKWLUCGA7LjL/n:+Dn4oRPDLUFsL/
                                                                                                                                                                                                                                          MD5:B3E7D84CF0B8A2298C89F91F084C0809
                                                                                                                                                                                                                                          SHA1:CE8389EE3CDEBD3DEA5628A441971C723D835D8C
                                                                                                                                                                                                                                          SHA-256:E9FFA7AB9823450EDDC6F312504281D6C9D87BDD89B3E4B4478C2E22FAC1E55B
                                                                                                                                                                                                                                          SHA-512:69BD25B2F3F76A8A763749C91745828A1EB05B103A543BF691D72757CE9E70F3EBC1D153F094ED081CE06172F62AC3E8CBD1E69849B92854C32693D2915510D5
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:nw.Window.get().evalNWBin(null, "static/js/3.cf9f4ce6.chunk.bin");

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ui\static\js\3.cf9f4ce6.chunk.js.map

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):9898
                                                                                                                                                                                                                                          Entropy (8bit):5.1083863257804785
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:192:fHLn4vlsHvjvxo7FUhWnl68oC4k0XiajoQgJhMiatsCPOQ:fHL4vYvjvxo7Fq8oCmXiajsWmQ
                                                                                                                                                                                                                                          MD5:B079CA1E88F9F0249B645CF6809C0059
                                                                                                                                                                                                                                          SHA1:4AE49B4802E3ECDDCBC00E54487B1ED6A2DB66F8
                                                                                                                                                                                                                                          SHA-256:C43B883FF47319D6301976F55CBA18CDCF29DB95D79EDED8926C9C4FF93AE76F
                                                                                                                                                                                                                                          SHA-512:4F9F19403A05360738085E3D1849A86F20124EA04635F0DE4806C65EDEA26812D23CA1AF0AA7DC7201BC7EEE9B0E5B80FF58214718BA3114F65CEE716439BB21
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:{"version":3,"sources":["../node_modules/web-vitals/dist/web-vitals.js"],"names":["e","t","n","i","a","name","value","delta","entries","id","concat","Date","now","Math","floor","random","r","PerformanceObserver","supportedEntryTypes","includes","self","getEntries","map","observe","type","buffered","o","document","visibilityState","removeEventListener","addEventListener","c","persisted","u","WeakSet","Set","f","has","s","hadRecentInput","push","takeRecords","m","p","v","timeStamp","d","setTimeout","l","disconnect","startTime","add","performance","getEntriesByName","requestAnimationFrame","h","passive","capture","S","y","w","g","entryType","target","cancelable","processingStart","forEach","E","L","T","once","b","getEntriesByType","timing","max","navigationStart","responseStart","readyState"],"mappings":"8GAAA,+MAAIA,EAAEC,EAAEC,EAAEC,EAAEC,EAAE,SAASJ,EAAEC,GAAG,MAAM,CAACI,KAAKL,EAAEM,WAAM,IAASL,GAAG,EAAEA,EAAEM,MAAM,EAAEC,QAAQ,GAAGC,GAAG,MAAMC,OAAOC,KAAKC,MAAM,KAAKF,OAAOG,KAAKC,MAAM,cAAc

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ui\static\js\main.717b6389.chunk.bin

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):465368
                                                                                                                                                                                                                                          Entropy (8bit):6.14942830048273
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:6144:s+MUPkfXHj7+mCQmv5b7sSQyc6bwQEtlFiiE2Udd7sgoycSgaJ7sgo07sgoyoJ3z:zFPkP/+mCVGrDXtwYdvgk
                                                                                                                                                                                                                                          MD5:5D4D79F5E8C4C5BE596D0D29FE390DB8
                                                                                                                                                                                                                                          SHA1:BE21E4FB8E1068A14754A02BD6189A38240B0047
                                                                                                                                                                                                                                          SHA-256:6F0FE0DF3138C4D6793991EA974B6F63F982F86652E8DDFC4E33EE70A5EFB88C
                                                                                                                                                                                                                                          SHA-512:20CC4165405DC4E0EDEC3AC1713973EB94DAAAAF26EA6CB5FC9EB59321DC85583182916E125744D4C85FAD26F89C1CF08EA8A7F67C036F3BED5571157EBF3035
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:.............$..@...............,T.]...`l.......m.`.....5.L`.....!..$Rg.......webpackJsonppc_app_store..........`......L`.......`......Ma........`.......`......L`.......`......Mc...........................`.......La..........Ec.................E`.....Eg.................................E...........................................................................................................................................................................................................................,T.8.`".......`......L`......Rc.b.....require...Rb........fs.....^.......@a..........Kc..........(...8.g............!......b...2.........$Sb............I`....Da............b.......... ..L.....Ia........Db............D`........Q.`l........<..,T.8..`".......m.`......L`.....L..Rb.2M....net....^.......pa..........Kc..........(...<.g............!......b...2.........$Sb............I`....DaB...........b.......... ..de..........................,T.8.`".......`......L`.......Rb...h....http...^..

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ui\static\js\main.717b6389.chunk.js

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):69
                                                                                                                                                                                                                                          Entropy (8bit):4.8761250011309585
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:3:+BKSLDrbIoMLNLQJljRquKGnteyCLjL/n:+Dn4oRPLtfCLjL/
                                                                                                                                                                                                                                          MD5:99282C810B1320DD7DDF3F1E3C49BCB3
                                                                                                                                                                                                                                          SHA1:412001989210C2675F1F0F6867E7B76243D37B31
                                                                                                                                                                                                                                          SHA-256:77E053252D75F968C929769601E19EA05BBBB628307B99B23DBFE6DA511F9936
                                                                                                                                                                                                                                          SHA-512:953288399F2B8E45D37A8BBEF6D48725F303143E144077C265346A0D900AB1AE8FE8A22B543BC32E8E37C80C840ED1AEBA6C0CC603B0DE126EFFE92B194166AA
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:nw.Window.get().evalNWBin(null, "static/js/main.717b6389.chunk.bin");

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ui\static\js\main.717b6389.chunk.js.map

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):703789
                                                                                                                                                                                                                                          Entropy (8bit):5.361726899305513
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:6144:ccRN7mydOkBzbSqWTxlm4lxnXsQ2hVzhvFvVu7/QvLGCXB/qkcJ7aB71NxTKXY2R:GkkrlwvB7nWr
                                                                                                                                                                                                                                          MD5:2A430BD7263C0FF637BCE16595B14F25
                                                                                                                                                                                                                                          SHA1:1DDA5EB0085930E7F36C947799D7806F08C73D4B
                                                                                                                                                                                                                                          SHA-256:1095AB40B990F5B4BB57121D8A0DFA575D727B2BA227576260496C1F1E39CFA3
                                                                                                                                                                                                                                          SHA-512:340521BC1857EF3A8CF9EF2A247AD89C52BB481DAEA26200C23614D42D0BDC09EAD66356E7FA0D46C7EE1687125C5CAC4B2EC40E43DD863256A3894224317CA1
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:{"version":3,"sources":["../external \"fs\"","../external \"net\"","../external \"http\"","../external \"https\"","../external \"path\"","store/actionTypes/appActionTypes.js","store/reducers/appReducer.js","store/actionTypes/windowsActionTypes.js","store/reducers/windowsReducer.js","store/actionTypes/startMenuActionTypes.js","store/reducers/startMenuReducer.js","store/actionTypes/settingsActionTypes.js","store/reducers/settingsReducer.js","store/actionTypes/searchActionTypes.js","constants.js","store/reducers/searchReducer.js","store/actionTypes/offerActionTypes.js","store/reducers/offerReducer.js","store/actionTypes/topbarActionTypes.js","store/reducers/topbarReducer.js","store/actionTypes/notificationsActionTypes.js","store/reducers/notificationsReducer.js","store/actionTypes/widgetActionTypes.js","store/reducers/widgetReducer.js","store/reducers/rootReducer.js","store/store.js","store/actionCreators/appActionCreators.js","store/actionCreators/windowsActionCreators.js","store/actionC

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ui\static\js\runtime-main.cdd4f9cc.bin

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):6880
                                                                                                                                                                                                                                          Entropy (8bit):5.780693101615468
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:192:xic+H+F/xHMah4jd7U/qVvKcg9VSSZ3QpADbiEBzN+W5RTXY:jCQ1XkWCVicg9VDgpNYTRk
                                                                                                                                                                                                                                          MD5:4FA32B7B0E24BED1A9E2E639180C6DAC
                                                                                                                                                                                                                                          SHA1:929ECB83121E556DED3E3757CDF15F77CB215A66
                                                                                                                                                                                                                                          SHA-256:088A11BAAE726E4380E8CD4EF349AF27C15A574443F825BB94703B845E6B1F7B
                                                                                                                                                                                                                                          SHA-512:784F6C3D98B21B7E9A7442075D9C122AC04426D462A34FCCFD9394884AE18BEF8A5C742A4B8A6773DCA7D3E8A83032B736597804FD26FE631018E2C39C27D33E
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:........>....$..@...............,T.4..`........m.`......L`.....,T....`........`.....xL`8....\Sb..............!......a.......!...!....f$...........................I`....Da.........,T.-..`........`.....(L`..............................B...........(a.........xK|.....`.H...................8......c.(.<...0.......#.H..................(.<...H.............(.....{....$... ...<........x............/...../...../.....}..-...n...Y../...!...-....-....-......._......$...../....-........./..../...^........4.. ..P"..\.#...Iw...$.....;....$.-.!...-....-..%.-..'._....)......./.+.4..-...:./.......b..0-..2..-..4.]..6.a.8...:...-....-..;........}=._....>...a.@...(Sb.............a.`....Da....P.... .8..lB........ ........P...... ...../..........P...p.`.@..L.....Ia........Db............D`.....T.Q.`&...........$..,T....`........m.`......L`.........r............Pa.........HKp~.......<.......d...........T.........?........!..<. ........g.... ...P................-...n...q...../........-...n...#../.......

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ui\static\js\runtime-main.cdd4f9cc.js

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):71
                                                                                                                                                                                                                                          Entropy (8bit):4.7442478245494595
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:3:+BKSLDrbIoMLNLQJljRquKeOISOBnDsHKsen:+Dn4oRPxOIRhC8
                                                                                                                                                                                                                                          MD5:07D51995B0C40EB6A7D648682400933E
                                                                                                                                                                                                                                          SHA1:673509F2150E63B0B1C2DA099AAB362214571CBD
                                                                                                                                                                                                                                          SHA-256:F3AB2E215ED0CB5A170CECF2AF7B323810F0E48ACC15F255A9F87CFC2EFF8ECD
                                                                                                                                                                                                                                          SHA-512:79026CBCE83B9C1589B6A77F81842AA4D9015E645CDB8FC0BABCE54118897A45F4D1AC82787476FC7BAA9C71AE7BD6FA38DCCAE12884A8AB6152A316D69CEECC
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:nw.Window.get().evalNWBin(null, "static/js/runtime-main.cdd4f9cc.bin");

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ui\static\js\runtime-main.cdd4f9cc.js.map

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):12604
                                                                                                                                                                                                                                          Entropy (8bit):5.32907166018772
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:384:fUPtHULTmhOVrLDtitZ3Rud/vSwmQFy9UFTmCaFmD5X7hNPn:cPtHU0SvSwmQJFTmCaFoLbPn
                                                                                                                                                                                                                                          MD5:C7F90D5C550BFEECD43C415429428E79
                                                                                                                                                                                                                                          SHA1:0D542CE39CD81D11AC9A73A3C0F81219DFB2E986
                                                                                                                                                                                                                                          SHA-256:94AD0934D5C3FA12061BFF99B5CB495C0B6583E126E0D3CC99DCA62DCFFD8151
                                                                                                                                                                                                                                          SHA-512:092EDF55040DFC6EBA370A4A4F15397F2B25363A45FB9D686493EBAB669A9864C42483EDFF23BC708BC77537B52292F4D71FAA706DB4D7DD2649DBE4FA922F96
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:{"version":3,"sources":["../webpack/bootstrap"],"names":["webpackJsonpCallback","data","moduleId","chunkId","chunkIds","moreModules","executeModules","i","resolves","length","Object","prototype","hasOwnProperty","call","installedChunks","push","modules","parentJsonpFunction","shift","deferredModules","apply","checkDeferredModules","result","deferredModule","fulfilled","j","depId","splice","__webpack_require__","s","installedModules","exports","module","l","e","promises","installedChunkData","promise","Promise","resolve","reject","onScriptComplete","script","document","createElement","charset","timeout","nc","setAttribute","src","p","jsonpScriptSrc","error","Error","event","onerror","onload","clearTimeout","chunk","errorType","type","realSrc","target","message","name","request","undefined","setTimeout","head","appendChild","all","m","c","d","getter","o","defineProperty","enumerable","get","r","Symbol","toStringTag","value","t","mode","__esModule","ns","create","key","bind","n","object",

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ui\static\media\copy_icon.570b8027.svg

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):1370
                                                                                                                                                                                                                                          Entropy (8bit):5.283353360674453
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:24:2dVm5AXxGvObLfE6odI4/UB4esb1Fke5UZZMQQZn5/ZyY2nOFUig2FLy8:cVqAXQ8fEhN6obDUZZOPyPncUhyy8
                                                                                                                                                                                                                                          MD5:C28FE12628EAF4B73719080A13F8E1A5
                                                                                                                                                                                                                                          SHA1:4900054A3A0BA37B054F7E99826AF0008928AAB5
                                                                                                                                                                                                                                          SHA-256:EDEA379F1A676ED9E3ECF876A940EF2B6E8D9FB16804187D534CAE46F66F9BD1
                                                                                                                                                                                                                                          SHA-512:6E1A2CE50D6B545A26011D8E3339F4FA4C228FBEFEC53A9177BE51DBB12C3C0FDFA33B2A6490F89211647ADC4D8A38A1B34ECC1114DE6C6A8013A51F2DBB58B8
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:<?xml version="1.0" encoding="iso-8859-1"?>.. Generator: Adobe Illustrator 18.0.0, SVG Export Plug-In . SVG Version: 6.00 Build 0) -->..<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">..<svg version="1.1" id="Capa_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"... viewBox="0 0 210.107 210.107" style="enable-background:new 0 0 210.107 210.107;" xml:space="preserve">..<g>...<path style="fill:#c3c3c2;" d="M168.506,0H80.235C67.413,0,56.981,10.432,56.981,23.254v2.854h-15.38....c-12.822,0-23.254,10.432-23.254,23.254v137.492c0,12.822,10.432,23.254,23.254,23.254h88.271....c12.822,0,23.253-10.432,23.253-23.254V184h15.38c12.822,0,23.254-10.432,23.254-23.254V23.254C191.76,10.432,181.328,0,168.506,0z.... M138.126,186.854c0,4.551-3.703,8.254-8.253,8.254H41.601c-4.551,0-8.254-3.703-8.254-8.254V49.361....c0-4.551,3.703-8.254,8.254-8.254h88.271c4.551,0,8.253,3.703,8.253,8.254V186.854z M176.76,160.74

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ui\static\media\icon_calculator_gray.f29de877.svg

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):5175
                                                                                                                                                                                                                                          Entropy (8bit):3.933853115875902
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:96:FJpkgJIjAwPNke13W1eKL7T2+mb93ore1phgUT2v+CS:FJpk15zN1rhgUT2v+CS
                                                                                                                                                                                                                                          MD5:CF8666E7736704C07412232858C9CBA3
                                                                                                                                                                                                                                          SHA1:EE8666C41448498D22620353C27EB8489D763249
                                                                                                                                                                                                                                          SHA-256:E1E0907E45A212DD9EAD8243A6C1B07907BE5E51F4399AAB6531E285322B1925
                                                                                                                                                                                                                                          SHA-512:332195DB62034A4FB5D6D86B9F25BFBA5EF57C77B57EECDA23B9D5CB0D129B5684215C8DD45300B8A611926C3A593FF6447454F7B0A97B6FBC010C9B82DF8B1D
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:<svg width="14" height="15" viewBox="0 0 14 15" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M1.16071 0C4.77679 0 8.37054 0 11.9866 0C12.0089 0 12.0089 0.0223228 12.0312 0.0223228C12.7232 0.156251 13.1696 0.647323 13.1696 1.36161C13.1696 5.44643 13.1696 9.55357 13.1696 13.6384C13.1696 14.4196 12.5893 15 11.808 15C8.32589 15 4.84375 15 1.36161 15C1.16071 15 0.937499 14.9554 0.758927 14.8661C0.223213 14.6205 0 14.1741 0 13.5938C0 10.8705 0 8.14732 0 5.42411C0 4.08482 0 2.72322 0 1.38393C0 0.959823 0.156249 0.580358 0.491071 0.3125C0.669642 0.133929 0.915178 0.0446429 1.16071 0ZM12.2768 7.47768C12.2768 5.46875 12.2768 3.4375 12.2768 1.42857C12.2768 1.02679 12.1205 0.870536 11.7188 0.870536C8.28125 0.870536 4.84375 0.870536 1.42857 0.870536C1.02678 0.870536 0.870534 1.02679 0.870534 1.42857C0.870534 5.46875 0.870534 9.50893 0.870534 13.5491C0.870534 13.9509 1.02678 14.1071 1.42857 14.1071C4.86607 14.1071 8.30357 14.1071 11.7188 14.1071C12.1205 14.1071 12.2768 13.9509 12.2768 1

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ui\static\media\icon_calculator_white.cdac319f.svg

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):2823
                                                                                                                                                                                                                                          Entropy (8bit):4.491649868709728
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:48:cSA+fE1jgL58sH7b8NaRB0sKWDvFqfsGzlaQSUU+m2ALAX92VHcX12rtDkU5:W+fom1bbgEB0sKWDgUwlaMU+m2ALAt2d
                                                                                                                                                                                                                                          MD5:0F2E1681746D0E29CF14FE6D88B557D7
                                                                                                                                                                                                                                          SHA1:BB983801F298AF8693088BC47C6B62C5640D0BDF
                                                                                                                                                                                                                                          SHA-256:E958BEC8452B258F1A9103B8C5CA2ABE6ADDA0FA0F6D1D443E5122CF79BA1CB9
                                                                                                                                                                                                                                          SHA-512:C9BEBE4EBAE0C26B0355FEAEADA465CB111C740E2251279ABFBDC722C6E5A2B5780D136E23F256FD8B9A5013588789EA74021E11E472CDC4C181A57978889179
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:<?xml version="1.0" encoding="utf-8"?>.. Generator: Adobe Illustrator 22.1.0, SVG Export Plug-In . SVG Version: 6.00 Build 0) -->..<svg version="1.1" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"... viewBox="0 0 14 15" style="enable-background:new 0 0 14 15;" xml:space="preserve">..<style type="text/css">....st0{fill:#FFFFFF;}..</style>..<g>...<path class="st0" d="M1.2,0C4.8,0,8.4,0,12,0c0,0,0,0,0,0c0.7,0.1,1.1,0.6,1.1,1.3c0,4.1,0,8.2,0,12.3c0,0.8-0.6,1.4-1.4,1.4....c-3.5,0-7,0-10.4,0c-0.2,0-0.4,0-0.6-0.1C0.2,14.6,0,14.2,0,13.6c0-2.7,0-5.4,0-8.2c0-1.3,0-2.7,0-4C0,1,0.2,0.6,0.5,0.3....C0.7,0.1,0.9,0,1.2,0z M12.3,7.5c0-2,0-4,0-6c0-0.4-0.2-0.6-0.6-0.6c-3.4,0-6.9,0-10.3,0C1,0.9,0.9,1,0.9,1.4c0,4,0,8.1,0,12.1....c0,0.4,0.2,0.6,0.6,0.6c3.4,0,6.9,0,10.3,0c0.4,0,0.6-0.2,0.6-0.6C12.3,11.5,12.3,9.5,12.3,7.5z"/>...<path class="st0" d="M6.6,1.8c1.4,0,2.9,0,4.3,0c0.4,0,0.5,0.2,0.5,0.5c0,1.1,0,2.3,0,3.4c0,0.4-0.2,0.5-0.5,0.5....c-2.9,

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ui\static\media\icon_check_gray.fc098a35.svg

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):854
                                                                                                                                                                                                                                          Entropy (8bit):4.266600052838456
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:24:twdvCuJNOLLgF1Q+HmplV5c0L/IgT6REUXvdZSz0LU:6dYAuZZrIgTJOvfy0Q
                                                                                                                                                                                                                                          MD5:6D54B2DFCD9A05985B1D2BDDFD513F60
                                                                                                                                                                                                                                          SHA1:DE6A21F663DB8895ADC4DB91BBD08A279301322F
                                                                                                                                                                                                                                          SHA-256:5586C361B2D63F488784A4140DBCC1A5D81FEB5ECB747CFCB420597D325F47BC
                                                                                                                                                                                                                                          SHA-512:E9A6C7ED962B0972E2DD333DA6340D721BF9BD4840B50E8D8A074AF315D2C3ED5502415856FD888FC3CD35116E013E18450EEFB8DD11BB03E9829CB886A8EDED
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:<svg width="20" height="16" viewBox="0 0 20 16" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M20 1.27078C19.8339 1.53302 19.6923 1.81505 19.492 2.04761C15.6234 6.5403 11.7451 11.0231 7.87163 15.5109C7.43202 16.0205 6.90938 16.1392 6.42092 15.8325C6.31346 15.7632 6.21577 15.6692 6.12785 15.5752C4.19356 13.4971 2.26904 11.409 0.334758 9.33092C-0.310005 8.63822 0.0514528 7.68327 0.784137 7.50515C1.13583 7.42103 1.45821 7.48535 1.73174 7.73275C1.85386 7.8416 1.96132 7.9653 2.07366 8.08405C3.66603 9.80592 5.26328 11.5278 6.85565 13.2497C6.88007 13.2744 6.89472 13.2991 6.9338 13.3437C7.00707 13.2596 7.07545 13.1903 7.13407 13.1161C10.7877 8.89551 14.4414 4.66505 18.0901 0.434588C18.5737 -0.124525 19.3162 -0.149265 19.7509 0.390057C19.8632 0.528598 19.917 0.711671 20 0.870004C20 1.00855 20 1.13719 20 1.27078Z" fill="#444444"/>..</svg>..

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ui\static\media\icon_check_white.f080410d.svg

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):852
                                                                                                                                                                                                                                          Entropy (8bit):4.275850671375772
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:24:twdvCuJNOLLgF1Q+HmplV5c0L/IgT6REUXvdZSz0LHA:6dYAuZZrIgTJOvfy00
                                                                                                                                                                                                                                          MD5:2CCC89303FC39BE9450730A8B415E094
                                                                                                                                                                                                                                          SHA1:F2E2BEB598038D58CC094C1AD1DEA58F2BB5F1BE
                                                                                                                                                                                                                                          SHA-256:E7503A4E3E81C886FAF1B512F0BA5A409927D8B192E329FF1BB6882816B6FA85
                                                                                                                                                                                                                                          SHA-512:D0E5C8118C813E786555CC2CD73D7D9BA0457A163E1D1F9B357A00A13DACCDC8E2963441C4CAFB07B960AF2980AF908E511DC74BC3BEDC3F5CCD25C7BD33EC08
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:<svg width="20" height="16" viewBox="0 0 20 16" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M20 1.27078C19.8339 1.53302 19.6923 1.81505 19.492 2.04761C15.6234 6.5403 11.7451 11.0231 7.87163 15.5109C7.43202 16.0205 6.90938 16.1392 6.42092 15.8325C6.31346 15.7632 6.21577 15.6692 6.12785 15.5752C4.19356 13.4971 2.26904 11.409 0.334758 9.33092C-0.310005 8.63822 0.0514528 7.68327 0.784137 7.50515C1.13583 7.42103 1.45821 7.48535 1.73174 7.73275C1.85386 7.8416 1.96132 7.9653 2.07366 8.08405C3.66603 9.80592 5.26328 11.5278 6.85565 13.2497C6.88007 13.2744 6.89472 13.2991 6.9338 13.3437C7.00707 13.2596 7.07545 13.1903 7.13407 13.1161C10.7877 8.89551 14.4414 4.66505 18.0901 0.434588C18.5737 -0.124525 19.3162 -0.149265 19.7509 0.390057C19.8632 0.528598 19.917 0.711671 20 0.870004C20 1.00855 20 1.13719 20 1.27078Z" fill="white"/>..</svg>..

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ui\static\media\icon_clipboard_gray.c8a9351b.svg

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):4743
                                                                                                                                                                                                                                          Entropy (8bit):3.9546492458044593
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:96:WvGuaiHhGE3LbNnWnbzPPFUKEcgVGoa59g04szf5u48xMg3vf:WOhiHJe3PPFUhc4Go8s6fAks
                                                                                                                                                                                                                                          MD5:386F6BF2308D42F9D6E2B56C6BFB0C51
                                                                                                                                                                                                                                          SHA1:F59465E5D827949B20728DE697019C28F3E58C78
                                                                                                                                                                                                                                          SHA-256:4091F05BAFD814DA9D094477C087FEBAD0ADBC9910CFF507EEAC4B58FD207139
                                                                                                                                                                                                                                          SHA-512:FB972C58B6B05BFF4D625807B675855C3CD4112D798361DCDAFD8F26521684FAA69EEEC380043DB21759EE51727315BB2632AFE03CB3CB57AB684D5CD9A065D8
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:<svg width="11" height="15" viewBox="0 0 11 15" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M8.19271 0C8.45052 0.0894632 8.65104 0.238569 8.73698 0.53678C8.76563 0.626243 8.76563 0.745525 8.76563 0.864809C8.88021 0.864809 8.99479 0.864809 9.08073 0.864809C9.33854 0.864809 9.59635 0.864813 9.82552 0.924455C10.513 1.07356 10.9714 1.72962 11 2.44533C11 2.80318 11 3.16103 11 3.51889C11 6.76938 11 10.0497 11 13.3002C11 13.9861 10.7135 14.5229 10.112 14.8509C9.91146 14.9404 9.68229 15 9.45313 15C6.81771 15 4.18229 15 1.51823 15C0.658851 15 0 14.2843 0 13.3598C0 11.004 0 8.61829 0 6.26242C0 5.03976 0 3.78728 0 2.56461C0 1.84891 0.286453 1.31213 0.916662 1.01391C1.11718 0.924451 1.375 0.89463 1.60417 0.864809C1.80469 0.834988 2.03385 0.864809 2.26302 0.864809C2.26302 0.805167 2.26302 0.745525 2.26302 0.715704C2.29167 0.387672 2.4349 0.149107 2.72135 0.0298229C2.75 0.0298229 2.77864 0 2.80729 0C4.64062 0 6.41667 0 8.19271 0ZM2.29167 1.75944C2.09115 1.75944 1.89062 1.75944 1.6901 1

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ui\static\media\icon_clipboard_white.2afacb39.svg

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):4729
                                                                                                                                                                                                                                          Entropy (8bit):3.9826071199242548
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:96:WvGuaiHhGE3LbNnWnuzUPFUKEcpVGda59g04Rzf5u47xMg3vc:WOhiHJegUPFUhc7Gd8slfA9X
                                                                                                                                                                                                                                          MD5:7B3329DB8105F1C10A0432343AA96772
                                                                                                                                                                                                                                          SHA1:4AC72B85DCF695F50F6DD28A37B98A21DBAB0AF3
                                                                                                                                                                                                                                          SHA-256:50FDF658E0D765F71D1265B574BA6EE514AF0BFC6057CEAC817E84906BA1A627
                                                                                                                                                                                                                                          SHA-512:6E844379BDE23E22A19739B405F8193ABFE0C1A640D46C0004747CDBC41228B5E6C4A0428479EC38DDD1A7D60BAE247E44E05877357F3BDFE6BFB53592F1B5E1
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:<svg width="11" height="15" viewBox="0 0 11 15" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M8.19271 0C8.45052 0.0894632 8.65104 0.238569 8.73698 0.53678C8.76563 0.626243 8.76563 0.745525 8.76563 0.864809C8.88021 0.864809 8.99479 0.864809 9.08073 0.864809C9.33854 0.864809 9.59635 0.864813 9.82552 0.924455C10.513 1.07356 10.9714 1.72962 11 2.44533C11 2.80318 11 3.16103 11 3.51889C11 6.76938 11 10.0497 11 13.3002C11 13.9861 10.7135 14.5229 10.112 14.8509C9.91146 14.9404 9.68229 15 9.45313 15C6.81771 15 4.18229 15 1.51823 15C0.658851 15 0 14.2843 0 13.3598C0 11.004 0 8.61829 0 6.26242C0 5.03976 0 3.78728 0 2.56461C0 1.84891 0.286453 1.31213 0.916662 1.01391C1.11718 0.924451 1.375 0.89463 1.60417 0.864809C1.80469 0.834988 2.03385 0.864809 2.26302 0.864809C2.26302 0.805167 2.26302 0.745525 2.26302 0.715704C2.29167 0.387672 2.4349 0.149107 2.72135 0.0298229C2.75 0.0298229 2.77864 0 2.80729 0C4.64062 0 6.41667 0 8.19271 0ZM2.29167 1.75944C2.09115 1.75944 1.89062 1.75944 1.6901 1

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ui\static\media\icon_cross_gray_2.01bfd543.svg

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):1592
                                                                                                                                                                                                                                          Entropy (8bit):4.004290849514056
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:24:tVvnjuJt7JBGAYIhm2mrLaqtQuFSgjmBwaonaOSvxZG2LvwuZ3+DExmbRlpQmNcs:rn6zGIkJrLTFVmKoZJLQ4gRCai6fWM
                                                                                                                                                                                                                                          MD5:D9F81AE3849F84F6F219B2831F088247
                                                                                                                                                                                                                                          SHA1:A0F7835AA9CD1261E3E2839B41055A3DD24A8637
                                                                                                                                                                                                                                          SHA-256:DA9DFE3D7B3033B518E8E2BD6C708A0F30F28E6013E696F8CEF108D2B64E0F35
                                                                                                                                                                                                                                          SHA-512:21D60604A97B9C084D924EA8C3C258990F818F2D44621C5F7D14380736BCF05ACDFF0DF31C5F9E71EAF68977FD2CA790E57AA6FFBF803DE1F88A45FAEBD3587F
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:<svg width="16" height="16" viewBox="0 0 16 16" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M0.930186 15.0723C0.877158 14.88 0.80093 14.6911 0.784359 14.4956C0.761161 14.1741 0.933506 13.9288 1.15225 13.7101C2.94199 11.9204 4.73173 10.1306 6.52146 8.34088C6.58112 8.28122 6.64078 8.22156 6.72032 8.14202C6.65072 8.07242 6.59438 8.01608 6.53472 7.95642C4.77152 6.19322 3.01494 4.42338 1.24511 2.67344C0.800997 2.23595 0.638599 1.78189 0.933576 1.20851C1.02638 1.11571 1.11918 1.02291 1.20866 0.933425C1.4009 0.880395 1.58981 0.804165 1.78535 0.787593C2.10684 0.764391 2.3521 0.936733 2.57085 1.15548C4.36056 2.94519 6.15028 4.73491 7.94331 6.52795C8.00297 6.5876 8.06263 6.64726 8.14217 6.7268C8.21177 6.6572 8.26812 6.60086 8.32777 6.5412C10.1275 4.74152 11.9271 2.94184 13.7268 1.14216C14.1312 0.73781 14.6151 0.671521 15.0525 0.943292C15.5165 1.23495 15.6458 1.88787 15.3309 2.3353C15.258 2.43473 15.1752 2.52422 15.0857 2.61371C13.3092 4.39019 11.5327 6.16667 9.75623 7.94315C9.69658

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ui\static\media\icon_cross_white_2.05921d5e.svg

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):1590
                                                                                                                                                                                                                                          Entropy (8bit):4.012220474436418
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:24:tVvnjuJt7JBGAYIhm2mrLaqtQuFSgjmBwaonaOSvxZG2LvwuZ3+DExmbRlpQmNcX:rn6zGIkJrLTFVmKoZJLQ4gRCai6fQ
                                                                                                                                                                                                                                          MD5:4DB5D94C4F838E720E17332EDF740EBC
                                                                                                                                                                                                                                          SHA1:D28ED3AD9E3A5EFE37DD1012C5F9F1E494C32883
                                                                                                                                                                                                                                          SHA-256:52151748BF54BE05AD5D26EB0FE3209E5EAFDEDB04AF6F1EB80D758E375A3E6C
                                                                                                                                                                                                                                          SHA-512:8264399F4119897182DFA43EA447DA2EF80ED6451677A66C12ECC4547BDCBD0762AA11CC3D89E948A32CA1C4B59952B267B2FADBDCB84A827E7DB2D66777837C
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:<svg width="16" height="16" viewBox="0 0 16 16" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M0.930186 15.0723C0.877158 14.88 0.80093 14.6911 0.784359 14.4956C0.761161 14.1741 0.933506 13.9288 1.15225 13.7101C2.94199 11.9204 4.73173 10.1306 6.52146 8.34088C6.58112 8.28122 6.64078 8.22156 6.72032 8.14202C6.65072 8.07242 6.59438 8.01608 6.53472 7.95642C4.77152 6.19322 3.01494 4.42338 1.24511 2.67344C0.800997 2.23595 0.638599 1.78189 0.933576 1.20851C1.02638 1.11571 1.11918 1.02291 1.20866 0.933425C1.4009 0.880395 1.58981 0.804165 1.78535 0.787593C2.10684 0.764391 2.3521 0.936733 2.57085 1.15548C4.36056 2.94519 6.15028 4.73491 7.94331 6.52795C8.00297 6.5876 8.06263 6.64726 8.14217 6.7268C8.21177 6.6572 8.26812 6.60086 8.32777 6.5412C10.1275 4.74152 11.9271 2.94184 13.7268 1.14216C14.1312 0.73781 14.6151 0.671521 15.0525 0.943292C15.5165 1.23495 15.6458 1.88787 15.3309 2.3353C15.258 2.43473 15.1752 2.52422 15.0857 2.61371C13.3092 4.39019 11.5327 6.16667 9.75623 7.94315C9.69658

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ui\static\media\icon_dashboard_gray.3a181243.svg

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):4264
                                                                                                                                                                                                                                          Entropy (8bit):3.894045254391696
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:96:+JHedx8iSdAwpGi30T09xMR99wgr+rBKD0iMt9V0BG:+JM+v+0fswcDMt9VgG
                                                                                                                                                                                                                                          MD5:E25CBB3FF275E58AF7891E0B857550A1
                                                                                                                                                                                                                                          SHA1:5FA0E6C032B080FC7A2E37ACADAA46D7F7AB04E2
                                                                                                                                                                                                                                          SHA-256:25FFBB8EEAC1F9A707570095599CE2349846836631CB2233D8273B4180425213
                                                                                                                                                                                                                                          SHA-512:BE2E449A4E86B723CA3881547F2CF11A305269EDE4DCB62EB94EEF44FC72E99EB0AE95B253735BD69BF10E814512B93AD8420193AF13598D0CEC987AA5F2A6C2
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:<svg width="20" height="21" viewBox="0 0 20 21" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M20.0001 10.7624L19.9644 10.7985C19.7505 11.593 19.2514 11.9903 18.4315 11.9903C16.542 11.9903 14.6525 11.9903 12.763 11.9903C12.6204 11.9903 12.5135 11.9903 12.3709 11.9903C11.4796 11.9903 10.8379 11.3402 10.8379 10.4374C10.8379 9.78739 10.8379 9.17347 10.8379 8.52344C10.8379 6.32057 10.8379 4.1538 10.8379 1.95092C10.8379 0.903652 11.1231 0.506411 12.0857 0.181396C14.3316 0.181396 16.542 0.181396 18.788 0.181396C19.1088 0.289735 19.4653 0.434186 19.6436 0.723088C19.7862 0.939764 19.8575 1.19255 19.9644 1.44534C20.0001 4.58715 20.0001 7.69285 20.0001 10.7624ZM18.7523 6.14C18.7523 4.69549 18.7523 3.28709 18.7523 1.84258C18.7523 1.55368 18.7167 1.51757 18.4315 1.51757C16.435 1.51757 14.4386 1.51757 12.4422 1.51757C12.157 1.51757 12.0857 1.55368 12.0857 1.84258C12.0857 4.69549 12.0857 7.58451 12.0857 10.4374C12.0857 10.7263 12.157 10.7985 12.4422 10.7985C14.4386 10.7985 16.435 10.7985

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ui\static\media\icon_dashboard_white.a91ae220.svg

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):4238
                                                                                                                                                                                                                                          Entropy (8bit):3.914834455290012
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:96:bMT1fU8EHCzbublIDQqirLwl4w1y97ZgILgzB:bS1giubk6kwtgILgzB
                                                                                                                                                                                                                                          MD5:2A64F22D46EF697D361BC13F4E5EC382
                                                                                                                                                                                                                                          SHA1:8F4277EA88024B458509538814E3A50BD20F0F04
                                                                                                                                                                                                                                          SHA-256:33629801FE35C15E2803A47C1ED0B8E21F38114119F05D64EBD65E5DA246B7CA
                                                                                                                                                                                                                                          SHA-512:6A9FC6FC4526D36FC259BF104F35418FB0914E32314975666E8EF01BC1D940263CC2F3109051E112A26A7FE42895762729F3FF5DC1E4C6D8ADF2A0E1CFD410E9
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:<svg width="20" height="20" viewBox="0 0 20 20" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M20.0001 10.4456L19.9644 10.4813C19.7505 11.2656 19.2514 11.6578 18.4315 11.6578C16.542 11.6578 14.6525 11.6578 12.763 11.6578C12.6204 11.6578 12.5135 11.6578 12.3709 11.6578C11.4796 11.6578 10.8379 11.016 10.8379 10.1248C10.8379 9.48307 10.8379 8.87701 10.8379 8.23529C10.8379 6.06061 10.8379 3.92157 10.8379 1.74688C10.8379 0.713012 11.1231 0.320856 12.0857 0C14.3316 0 16.542 0 18.788 0C19.1088 0.106952 19.4653 0.249554 19.6436 0.534759C19.7862 0.748663 19.8575 0.998217 19.9644 1.24777C20.0001 4.34938 20.0001 7.41533 20.0001 10.4456ZM18.7523 5.88235C18.7523 4.45633 18.7523 3.06595 18.7523 1.63993C18.7523 1.35472 18.7167 1.31907 18.4315 1.31907C16.435 1.31907 14.4386 1.31907 12.4422 1.31907C12.157 1.31907 12.0857 1.35472 12.0857 1.63993C12.0857 4.45633 12.0857 7.30838 12.0857 10.1248C12.0857 10.41 12.157 10.4813 12.4422 10.4813C14.4386 10.4813 16.435 10.4813 18.4315 10.4813C18.7167

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ui\static\media\icon_gamepad_gray.d7229273.svg

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):6098
                                                                                                                                                                                                                                          Entropy (8bit):3.8868971852897896
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:96:2masVg2zPxVlBJr0GVdGrp7YAFPa6aswXXoluwFw0wsOVmc0BLMpHLJklLMp+sLQ:+sVg2zPxjjVdgpMAFPaJ3HoluwFw0wVq
                                                                                                                                                                                                                                          MD5:8EBCB6408685047BE3BD1996D4000EE4
                                                                                                                                                                                                                                          SHA1:F16881FF86F16B8C4D725E17584ECE870CD6727F
                                                                                                                                                                                                                                          SHA-256:BA281665918CA2AB863CE98626153153931F2D99FEE645F7479118F91C66C9F2
                                                                                                                                                                                                                                          SHA-512:276FD1A09BDE77261210114F5FE6E3C796DAA6C85183CC206200B9BB0D148AB914981AE162A0D9FF901171A394A98708E672A8C002FDBEB4138488BF80944C5F
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:<svg width="16" height="11" viewBox="0 0 16 11" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M16 8.62987C15.9472 8.92217 15.9117 9.21777 15.8394 9.50569C15.7505 9.90773 15.5371 10.275 15.2269 10.56C14.6695 11.057 13.8597 11.138 13.1554 10.7669C12.6421 10.4875 12.1924 10.1131 11.8329 9.66553C11.4245 9.17616 11.0495 8.66271 10.6675 8.15364C10.6453 8.11432 10.6121 8.08164 10.5716 8.05922C10.5311 8.0368 10.4849 8.02553 10.4381 8.02664C8.81238 8.03102 7.18705 8.03102 5.5621 8.02664C5.51686 8.02284 5.47145 8.03194 5.43163 8.0528C5.39182 8.07365 5.35938 8.10532 5.33844 8.14378C4.90194 8.82765 4.38931 9.46449 3.80946 10.0432C3.47452 10.3927 3.06867 10.6735 2.61655 10.8687C2.2413 11.0212 1.82147 11.0416 1.43196 10.9261C1.04246 10.8106 0.708611 10.5667 0.489974 10.2381C0.217225 9.81192 0.0595757 9.32778 0.0311659 8.82912C-0.0766541 7.71682 0.109163 6.6286 0.375272 5.55243C0.728555 4.12921 1.22177 2.74649 1.97078 1.46231C2.19701 1.09466 2.45605 0.746321 2.74502 0.421172C2.85915 0.287

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ui\static\media\icon_gamepad_white.25a7995d.svg

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):6086
                                                                                                                                                                                                                                          Entropy (8bit):3.9063223215918432
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:96:2masVg2zPxVlBJr0GVdGrp7YAFPa6RswXXoluwFw0wsOVmc0BLMpHLQklLxp+bLC:+sVg2zPxjjVdgpMAFPaq3HoluwFw0wVt
                                                                                                                                                                                                                                          MD5:048482A7B181541A174551C016205A44
                                                                                                                                                                                                                                          SHA1:5A5C2E2F813768E3C3C096ABDB209F55C5F2FCE3
                                                                                                                                                                                                                                          SHA-256:968A15C711DA89D4A150521A1889633C5967731EAB81C6A14DFFA352B325BC7E
                                                                                                                                                                                                                                          SHA-512:873070DE6578A9751FB2718F2C73E6ED8FA15F0C76C34D03E0A359658F5B885EFC5388DDDFB458CCFB99D44025983EAFCD595DE7C6218F1DAC81228D75F40F4C
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:<svg width="16" height="11" viewBox="0 0 16 11" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M16 8.62987C15.9472 8.92217 15.9117 9.21777 15.8394 9.50569C15.7505 9.90773 15.5371 10.275 15.2269 10.56C14.6695 11.057 13.8597 11.138 13.1554 10.7669C12.6421 10.4875 12.1924 10.1131 11.8329 9.66553C11.4245 9.17616 11.0495 8.66271 10.6675 8.15364C10.6453 8.11432 10.6121 8.08164 10.5716 8.05922C10.5311 8.0368 10.4849 8.02553 10.4381 8.02664C8.81238 8.03102 7.18705 8.03102 5.5621 8.02664C5.51686 8.02284 5.47145 8.03194 5.43163 8.0528C5.39182 8.07365 5.35938 8.10532 5.33844 8.14378C4.90194 8.82765 4.38931 9.46449 3.80946 10.0432C3.47452 10.3927 3.06867 10.6735 2.61655 10.8687C2.2413 11.0212 1.82147 11.0416 1.43196 10.9261C1.04246 10.8106 0.708611 10.5667 0.489974 10.2381C0.217225 9.81192 0.0595757 9.32778 0.0311659 8.82912C-0.0766541 7.71682 0.109163 6.6286 0.375272 5.55243C0.728555 4.12921 1.22177 2.74649 1.97078 1.46231C2.19701 1.09466 2.45605 0.746321 2.74502 0.421172C2.85915 0.287

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ui\static\media\icon_gear_gray.545673b6.svg

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):6801
                                                                                                                                                                                                                                          Entropy (8bit):3.7386877939405805
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:192:VPxlcoEiWxAGY/Eetsf/k9aLNyh6JwpM2LkgL8en:Jx2CyAhtsE9aZLT/gv
                                                                                                                                                                                                                                          MD5:6DD649E7B024D0758023476637791EFF
                                                                                                                                                                                                                                          SHA1:47EAC14A729C1A1C314C644BD28FA8C7D8B6D24D
                                                                                                                                                                                                                                          SHA-256:663F3C16A7075FF42266008720D8D859F54E366040496F95E828E892DCAE6A7E
                                                                                                                                                                                                                                          SHA-512:3887A01D6329B979A683A6322508FD75C6C66369605133FBFA373E503CC2A199204002E5FEB382D163D67CB2DFBCD698AFB57C770916C1A5B6BB592261A1FE7C
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:<svg width="21" height="21" viewBox="0 0 21 21" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M9.56484 0C10.1938 0 10.8227 0 11.4516 0C11.4734 0.0109432 11.4953 0.0273583 11.5227 0.0328299C12.3539 0.207921 12.9336 0.798855 13.0703 1.63054C13.1031 1.82204 13.0977 2.02449 13.0922 2.22147C13.0922 2.33637 13.125 2.38562 13.2344 2.42392C13.4859 2.51147 13.732 2.60995 13.9781 2.71391C14.1203 2.7741 14.2734 2.90542 14.4047 2.88901C14.5305 2.86712 14.6344 2.6975 14.7492 2.58807C15.5203 1.86582 16.6469 1.8494 17.418 2.57165C17.7789 2.90542 18.1289 3.2556 18.457 3.61673C18.8891 4.09276 19.0367 4.65633 18.9164 5.29104C18.8398 5.71782 18.6156 6.06253 18.3094 6.358C18.0742 6.58781 18.0797 6.58781 18.2109 6.8778C18.3148 7.10761 18.4133 7.34289 18.5008 7.57817C18.6266 7.91193 18.6211 7.91193 18.9766 7.91193C19.8516 7.91741 20.5461 8.35513 20.8523 9.11569C20.9125 9.25795 20.9508 9.41115 21 9.55889C21 10.1881 21 10.8174 21 11.4466C20.9836 11.4904 20.9672 11.5341 20.9563 11.5779C20.8141 12.1

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ui\static\media\icon_gear_white.2bba31c1.svg

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):6797
                                                                                                                                                                                                                                          Entropy (8bit):3.744755737482207
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:192:VPxlcoEiWxAGY/Eetsf/k9aLNyh6JwpM2LkgLbe0:Jx2CyAhtsE9aZLT/gV
                                                                                                                                                                                                                                          MD5:C29E6ED919C2A6DE97D06B2AE745DE71
                                                                                                                                                                                                                                          SHA1:D5FBD0DBFBD471CE494FD822C8846D4460BD1545
                                                                                                                                                                                                                                          SHA-256:2B35B1B5EAB5E23F2FE6E3B1178A81933241006D56FC2731E40323B5E6AEE94A
                                                                                                                                                                                                                                          SHA-512:07C65E7CB30FA0D0B8054EDAB7AA9AA0625826C4327681E14AC06849C7DBD0722F2487D9564ADCF2CDF819352E78492B65620C0352F043818D4839674D21B2F0
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:<svg width="21" height="21" viewBox="0 0 21 21" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M9.56484 0C10.1938 0 10.8227 0 11.4516 0C11.4734 0.0109432 11.4953 0.0273583 11.5227 0.0328299C12.3539 0.207921 12.9336 0.798855 13.0703 1.63054C13.1031 1.82204 13.0977 2.02449 13.0922 2.22147C13.0922 2.33637 13.125 2.38562 13.2344 2.42392C13.4859 2.51147 13.732 2.60995 13.9781 2.71391C14.1203 2.7741 14.2734 2.90542 14.4047 2.88901C14.5305 2.86712 14.6344 2.6975 14.7492 2.58807C15.5203 1.86582 16.6469 1.8494 17.418 2.57165C17.7789 2.90542 18.1289 3.2556 18.457 3.61673C18.8891 4.09276 19.0367 4.65633 18.9164 5.29104C18.8398 5.71782 18.6156 6.06253 18.3094 6.358C18.0742 6.58781 18.0797 6.58781 18.2109 6.8778C18.3148 7.10761 18.4133 7.34289 18.5008 7.57817C18.6266 7.91193 18.6211 7.91193 18.9766 7.91193C19.8516 7.91741 20.5461 8.35513 20.8523 9.11569C20.9125 9.25795 20.9508 9.41115 21 9.55889C21 10.1881 21 10.8174 21 11.4466C20.9836 11.4904 20.9672 11.5341 20.9563 11.5779C20.8141 12.1

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ui\static\media\icon_notification_gray.e0145c50.svg

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):3605
                                                                                                                                                                                                                                          Entropy (8bit):3.914389459303166
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:96:FIQXafQMoWADNaEoUFXMl10h+DNs9eKjrOIntIE:F7XgiDNaEvs1SGCrOItB
                                                                                                                                                                                                                                          MD5:477A237F6AE8615FA3C957919C161FFC
                                                                                                                                                                                                                                          SHA1:735FF4EB4377A45B2D2D5A8E7C305F6B6AF287C7
                                                                                                                                                                                                                                          SHA-256:A676CCE75141D03F6264C5D65398BE6021379FEF9A2BB25BA64549EFB8066B42
                                                                                                                                                                                                                                          SHA-512:5663DA1BF748E3A62A4D5919C4E1FEFE95DF60AB46E9DA6C03B6417854CC9A516F38C5EA14AB21A775EA9D3BA0630D830AF7379CC62FC17E84EA18B402666D30
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:<svg width="14" height="15" viewBox="0 0 14 15" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M13.98 6.12847C13.98 6.2105 13.9925 6.29644 13.9759 6.37457C13.9344 6.59722 13.7107 6.75347 13.4828 6.73394C13.2424 6.71441 13.0601 6.53082 13.0559 6.28863C13.0476 5.76519 12.9813 5.24957 12.828 4.74175C12.5504 3.82379 12.0614 3.0191 11.3611 2.3316C11.1042 2.0816 11.0793 1.81597 11.2906 1.62457C11.502 1.43316 11.7838 1.47222 12.0365 1.72222C13.0684 2.74175 13.6982 3.94488 13.9179 5.33941C13.9593 5.60113 13.9717 5.86285 14.0007 6.12457C13.9883 6.12847 13.9842 6.12847 13.98 6.12847Z" fill="#494444"/>..<path d="M7.1786 0C7.39409 0.0859375 7.63029 0.148438 7.82505 0.269531C8.19386 0.503906 8.37205 0.859375 8.38863 1.28125C8.39691 1.5 8.38863 1.71875 8.38863 1.94141C8.59582 2.01953 8.79887 2.08203 8.99364 2.17188C10.7879 3.01563 11.7369 4.38281 11.8074 6.27734C11.8322 6.92969 11.7991 7.58594 11.8405 8.23828C11.9275 9.54297 12.4041 10.7187 13.2163 11.7734C13.3986 12.0078 13.6058 12.2305

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ui\static\media\icon_notification_white.addda272.svg

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):3599
                                                                                                                                                                                                                                          Entropy (8bit):3.928807214825618
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:96:FIQXafQMoW3DNaEoUFXMl10h+DNs9eKjrOIutI/:F7XgZDNaEvs1SGCrOIUu
                                                                                                                                                                                                                                          MD5:89DD3B8D872E8E8E8D51B3CD29C77023
                                                                                                                                                                                                                                          SHA1:E4D6DAA5097FFE044C8DF59692FC2F3ABCF45668
                                                                                                                                                                                                                                          SHA-256:A2DC2F231B7A3492ABCED87D8F1953CF313CFE3CDD32B38FEC3F6EDD270A26FD
                                                                                                                                                                                                                                          SHA-512:4E731CF642CBC3BEBC5C858073336B6D923227B690253378A47B8A5220E2F28EFC8D2D6602728F1DC2D13ED5EB95B5F889813FE89BBA7E55A6A487F01E510203
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:<svg width="14" height="15" viewBox="0 0 14 15" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M13.98 6.12847C13.98 6.2105 13.9925 6.29644 13.9759 6.37457C13.9344 6.59722 13.7107 6.75347 13.4828 6.73394C13.2424 6.71441 13.0601 6.53082 13.0559 6.28863C13.0476 5.76519 12.9813 5.24957 12.828 4.74175C12.5504 3.82379 12.0614 3.0191 11.3611 2.3316C11.1042 2.0816 11.0793 1.81597 11.2906 1.62457C11.502 1.43316 11.7838 1.47222 12.0365 1.72222C13.0684 2.74175 13.6982 3.94488 13.9179 5.33941C13.9593 5.60113 13.9717 5.86285 14.0007 6.12457C13.9883 6.12847 13.9842 6.12847 13.98 6.12847Z" fill="white"/>..<path d="M7.1786 0C7.39409 0.0859375 7.63029 0.148438 7.82505 0.269531C8.19386 0.503906 8.37205 0.859375 8.38863 1.28125C8.39691 1.5 8.38863 1.71875 8.38863 1.94141C8.59582 2.01953 8.79887 2.08203 8.99364 2.17188C10.7879 3.01563 11.7369 4.38281 11.8074 6.27734C11.8322 6.92969 11.7991 7.58594 11.8405 8.23828C11.9275 9.54297 12.4041 10.7187 13.2163 11.7734C13.3986 12.0078 13.6058 12.2305 13

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ui\static\media\icon_screenshot_gray.01873dbe.svg

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):2232
                                                                                                                                                                                                                                          Entropy (8bit):3.9969278840420657
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:48:h3bDj6YrB+De50bRzctlW9MMCQ1zzC0lm6xM:1Dj6YsymRzpCTQ1zzC0li
                                                                                                                                                                                                                                          MD5:73CD1627E147A8EAD813AD7201D75876
                                                                                                                                                                                                                                          SHA1:9873BA2A53794A91E4DFB617D0D713DCC1EF5AFA
                                                                                                                                                                                                                                          SHA-256:27AF99AEF7A11E5806946F03234615F4F96576936C87BF3E256572AD6D35BB3B
                                                                                                                                                                                                                                          SHA-512:5EE5A96FC914E6D2E4481003B817F8CFA647C447CBA2254EB83EC75E606DACBDA1520D0C0CAF789103B53FC47CB825539748E703CAC99D41BB02A1E64711C7CA
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:<svg width="12" height="14" viewBox="0 0 12 14" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M7.09854 10.2731C7.43835 9.88812 7.85096 9.62347 8.33639 9.50318C9.59851 9.19042 10.8849 9.98435 11.1519 11.2595C11.4189 12.5105 10.5451 13.7615 9.25871 13.954C7.94805 14.1705 6.73447 13.2323 6.61311 11.9331C6.58884 11.7166 6.51602 11.476 6.44321 11.2595C6.17622 10.4415 5.90923 9.62347 5.66652 8.80548C5.64225 8.75736 5.64225 8.70924 5.61798 8.63707C5.59371 8.70924 5.56943 8.7333 5.54516 8.78142C5.22963 9.74376 4.9141 10.7302 4.62284 11.6925C4.5743 11.8369 4.5743 11.9812 4.55003 12.1496C4.30731 13.3285 3.19082 14.1465 2.02578 13.9781C0.763661 13.8097 -0.110117 12.727 0.0112413 11.5C0.108328 10.5618 0.642303 9.88812 1.54035 9.57535C2.4384 9.26259 3.23936 9.47912 3.91897 10.1287C3.96751 10.1768 4.01605 10.2249 4.0646 10.2731C4.08887 10.2249 4.11314 10.1768 4.11314 10.1287C5.15682 6.90485 6.17622 3.65694 7.2199 0.433091C7.29272 0.240623 7.3898 0.0722124 7.60825 0.0240953C7.97232 -0.048

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ui\static\media\icon_screenshot_white.0e82acc2.svg

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):2228
                                                                                                                                                                                                                                          Entropy (8bit):4.011244246624798
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:48:h3bDj6YrB+De50bRzctlWRMCQ1zzC0lm6t:1Dj6YsymRzpRTQ1zzC0lt
                                                                                                                                                                                                                                          MD5:D4950E85D1EDD93F20A610F0B9575A1B
                                                                                                                                                                                                                                          SHA1:6CF6227A85D9111DBBD9A23A2BBA528D31B591A2
                                                                                                                                                                                                                                          SHA-256:4702B18CB5FAA0D6F56176EBE21011D2E994736BA0AFC52C961E3950F45E61EA
                                                                                                                                                                                                                                          SHA-512:15B47F230A966FEFCBE1BA1BC6D700FACF7978B22A7913388C3269D13A140AA634364121473A7152997EE5146FC5BED9697C00D7018F025CEB6BFB3018C64ABD
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:<svg width="12" height="14" viewBox="0 0 12 14" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M7.09854 10.2731C7.43835 9.88812 7.85096 9.62347 8.33639 9.50318C9.59851 9.19042 10.8849 9.98435 11.1519 11.2595C11.4189 12.5105 10.5451 13.7615 9.25871 13.954C7.94805 14.1705 6.73447 13.2323 6.61311 11.9331C6.58884 11.7166 6.51602 11.476 6.44321 11.2595C6.17622 10.4415 5.90923 9.62347 5.66652 8.80548C5.64225 8.75736 5.64225 8.70924 5.61798 8.63707C5.59371 8.70924 5.56943 8.7333 5.54516 8.78142C5.22963 9.74376 4.9141 10.7302 4.62284 11.6925C4.5743 11.8369 4.5743 11.9812 4.55003 12.1496C4.30731 13.3285 3.19082 14.1465 2.02578 13.9781C0.763661 13.8097 -0.110117 12.727 0.0112413 11.5C0.108328 10.5618 0.642303 9.88812 1.54035 9.57535C2.4384 9.26259 3.23936 9.47912 3.91897 10.1287C3.96751 10.1768 4.01605 10.2249 4.0646 10.2731C4.08887 10.2249 4.11314 10.1768 4.11314 10.1287C5.15682 6.90485 6.17622 3.65694 7.2199 0.433091C7.29272 0.240623 7.3898 0.0722124 7.60825 0.0240953C7.97232 -0.048

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ui\static\media\icon_search_gray.ebbaf632.svg

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):702
                                                                                                                                                                                                                                          Entropy (8bit):4.39074490019929
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:12:trVzNtuJlzaTATxgOyh0DIAK+aV/E4Ypk8FnOp8DQBW:tZzNtuJoTcxyu6fV7KbFnPsBW
                                                                                                                                                                                                                                          MD5:86893B121171A45F3494D301D57E80F1
                                                                                                                                                                                                                                          SHA1:739B6A99982CE3F6BF792876E72A8413D1583072
                                                                                                                                                                                                                                          SHA-256:4D8B0003A1DA38931E9BA26483D517CD59E62EA14759FC36F14B0F1EC558C6B8
                                                                                                                                                                                                                                          SHA-512:CABD9B44F635F3A1C9C8054004DE318FC3F875F6FD81DB722CD49FD29912E0720B656DD1BA81A5FF8B63C728A81A9A393618E0D18B07227F2AC937A954D9FEB0
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:<svg width="12" height="12" viewBox="0 0 12 12" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M0.146939 11.1478L3.03184 8.26286C2.31673 7.39102 1.88571 6.27429 1.88571 5.05714C1.88571 2.26531 4.15102 0 6.94286 0C9.73714 0 12 2.26531 12 5.05714C12 7.84898 9.73714 10.1143 6.94286 10.1143C5.72571 10.1143 4.61143 9.68571 3.73959 8.97061L0.854693 11.8531C0.658775 12.049 0.342857 12.049 0.146939 11.8531C-0.0489798 11.6596 -0.0489798 11.3412 0.146939 11.1478ZM6.94286 9.10775C9.17878 9.10775 10.9959 7.29061 10.9959 5.05714C10.9959 2.82367 9.17878 1.00408 6.94286 1.00408C4.70939 1.00408 2.8898 2.82367 2.8898 5.05714C2.8898 7.29061 4.70939 9.10775 6.94286 9.10775Z" fill="#827A7A"/>..</svg>..

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ui\static\media\icon_search_white.0c376446.svg

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):700
                                                                                                                                                                                                                                          Entropy (8bit):4.387297248681374
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:12:trVzNtuJlzaTATxgOyh0DIAK+aV/E4Ypk8FnOp8DQBiHAA:tZzNtuJoTcxyu6fV7KbFnPsBHA
                                                                                                                                                                                                                                          MD5:C6D2A075413FDBCB286B77A97F9B6F13
                                                                                                                                                                                                                                          SHA1:2DAA74C58338CAFE94A25CAB8FFB92253C140BCF
                                                                                                                                                                                                                                          SHA-256:A71D66F5B6FAC238513DAA379BAEE5B35F24EC42050DC21E056BF08310042888
                                                                                                                                                                                                                                          SHA-512:387762B3A3D0B7F694CF633926B3777AAA45DCA5A31DC7C095BC0B235B7D49CE5818BE76F2B032CF4E3031DEC520C5C67FAB879968C0F203E2A44EEA2EE0499F
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:<svg width="12" height="12" viewBox="0 0 12 12" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M0.146939 11.1478L3.03184 8.26286C2.31673 7.39102 1.88571 6.27429 1.88571 5.05714C1.88571 2.26531 4.15102 0 6.94286 0C9.73714 0 12 2.26531 12 5.05714C12 7.84898 9.73714 10.1143 6.94286 10.1143C5.72571 10.1143 4.61143 9.68571 3.73959 8.97061L0.854693 11.8531C0.658775 12.049 0.342857 12.049 0.146939 11.8531C-0.0489798 11.6596 -0.0489798 11.3412 0.146939 11.1478ZM6.94286 9.10775C9.17878 9.10775 10.9959 7.29061 10.9959 5.05714C10.9959 2.82367 9.17878 1.00408 6.94286 1.00408C4.70939 1.00408 2.8898 2.82367 2.8898 5.05714C2.8898 7.29061 4.70939 9.10775 6.94286 9.10775Z" fill="white"/>..</svg>..

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ui\static\media\icon_support_gray.a272cc7a.svg

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):3466
                                                                                                                                                                                                                                          Entropy (8bit):3.9394896115708424
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:48:qqr8WXm539LJck1/Syl7x6Ugu5mUctd2ji2REolr58DqJcgcBBs1Kmo6UZuEVlYd:4WXm53pJp/S86Uh58Gi2FV4ksShd
                                                                                                                                                                                                                                          MD5:97A4CAA52C453393A3ACEDB7EB240010
                                                                                                                                                                                                                                          SHA1:26353A64DD09BA4D0055D2F259266DABE7C1CC88
                                                                                                                                                                                                                                          SHA-256:0A5439D793597DA248595B59290A41123A36BA90D47554ABE4E64147455BD86F
                                                                                                                                                                                                                                          SHA-512:F1C236016CE294FDD70C584FAF045BF5DAF8DD4BBE2D453788CF78BB0397C61305C2C148651D9D8E52ECF08AF39264835781EF3A9496759870C7BA93A6BA2500
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:<svg width="21" height="21" viewBox="0 0 21 21" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M9.89765 0C10.3083 0 10.719 0 11.1297 0C11.1845 0.0136988 11.2392 0.0273993 11.294 0.0273993C12.7588 0.123291 14.1551 0.520555 15.442 1.23289C18.399 2.86305 20.206 5.34254 20.8357 8.67136C20.9179 9.06862 20.9452 9.47958 21 9.87685C21 10.2878 21 10.6988 21 11.1097C20.9863 11.1645 20.9726 11.233 20.9589 11.2878C20.8631 12.7536 20.4661 14.1372 19.7679 15.4249C18.1389 18.3838 15.661 20.1921 12.3344 20.8222C11.9374 20.9044 11.5267 20.9318 11.116 20.9866C10.6917 20.9866 10.2673 20.9866 9.84289 20.9866C9.59648 20.9592 9.35007 20.9318 9.08996 20.8907C7.78944 20.6989 6.57106 20.3154 5.42112 19.6852C5.33898 19.6441 5.20209 19.6304 5.10626 19.6578C4.59974 19.8085 4.10691 19.9729 3.60039 20.1373C2.72425 20.4249 1.8618 20.7126 0.985658 20.9866C0.87614 20.9866 0.766624 20.9866 0.657106 20.9866C0.328553 20.877 0.109518 20.6578 0 20.329C0 20.2195 0 20.1099 0 20.0003C0.0136897 19.9866 0.027379 19.9

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ui\static\media\icon_support_white.66ecfc42.svg

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):3460
                                                                                                                                                                                                                                          Entropy (8bit):3.951932320279216
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:48:qqr8WXm539LJck1qSyl7x6Ugu5mUctd2ji2REolr5RqJcgcBBs1Kmo63uEVlYanL:4WXm53pJpqS86Uh58Gi2FVLksSwa
                                                                                                                                                                                                                                          MD5:7BBD80A02464154C092ACBE7DD328730
                                                                                                                                                                                                                                          SHA1:C5E8862B03D566CCE19001910B1254D0293C1D9F
                                                                                                                                                                                                                                          SHA-256:F6B4616A88E746054F75133B879556D769B8A16395EDE1EFC723112BD41E218B
                                                                                                                                                                                                                                          SHA-512:53A0B00F505D6AC3B4E737540DD02036778BC89C521083352A20EE1E63136C4D72A9F6482752ADA6D8E415C6D384197FC393F5AED907A45F1209926DA9F80C48
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:<svg width="21" height="21" viewBox="0 0 21 21" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M9.89765 0C10.3083 0 10.719 0 11.1297 0C11.1845 0.0136988 11.2392 0.0273993 11.294 0.0273993C12.7588 0.123291 14.1551 0.520555 15.442 1.23289C18.399 2.86305 20.206 5.34254 20.8357 8.67136C20.9179 9.06862 20.9452 9.47958 21 9.87685C21 10.2878 21 10.6988 21 11.1097C20.9863 11.1645 20.9726 11.233 20.9589 11.2878C20.8631 12.7536 20.4661 14.1372 19.7679 15.4249C18.1389 18.3838 15.661 20.1921 12.3344 20.8222C11.9374 20.9044 11.5267 20.9318 11.116 20.9866C10.6917 20.9866 10.2673 20.9866 9.84289 20.9866C9.59648 20.9592 9.35007 20.9318 9.08996 20.8907C7.78944 20.6989 6.57106 20.3154 5.42112 19.6852C5.33898 19.6441 5.20208 19.6304 5.10626 19.6578C4.59974 19.8085 4.10691 19.9729 3.60039 20.1373C2.72425 20.4249 1.8618 20.7126 0.985658 20.9866C0.87614 20.9866 0.766624 20.9866 0.657106 20.9866C0.328553 20.877 0.109518 20.6578 0 20.329C0 20.2195 0 20.1099 0 20.0003C0.0136897 19.9866 0.027379 19.9

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ui\static\media\icon_trash_gray.4f9b6bc3.svg

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):4403
                                                                                                                                                                                                                                          Entropy (8bit):3.8960426134967934
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:96:sreYdijt0XCV30iqhzz9GaHPuPVsTasmBsoG2SuM2q6RW:saISGt95P6e2B4u7dW
                                                                                                                                                                                                                                          MD5:360145CB691391CCC038500BAD652269
                                                                                                                                                                                                                                          SHA1:4F2D87620766892151D6087962DCB08628FC1220
                                                                                                                                                                                                                                          SHA-256:4E9DBDEE102A27F7B339857D9B888EB218E00456E42D1CE3747E4810DC4087C5
                                                                                                                                                                                                                                          SHA-512:D2940AA1CBFC0ADE2AEFBCA312F077A23D84C7F4D1087D0D8FD87D9ADF7939AA9B2774AAE53B4A8F55AF4C946C7066193B5636FC44997F742B29A873E9EE5BEC
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:<svg width="13" height="15" viewBox="0 0 13 15" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M4.62038 0C5.87329 0 7.12258 0 8.37549 0C8.39354 0.00732064 8.41159 0.0183016 8.42965 0.0219619C9.02541 0.124451 9.44425 0.560029 9.51285 1.16764C9.53451 1.35798 9.51646 1.55564 9.51646 1.76061C9.59951 1.76061 9.65006 1.76061 9.70422 1.76061C10.3577 1.76061 11.0149 1.75695 11.6684 1.76061C12.3111 1.76428 12.8202 2.17057 12.9647 2.78184C13.1019 3.34919 12.8311 3.97511 12.3003 4.23499C12.127 4.31918 12.08 4.42167 12.08 4.58638C12.08 4.59736 12.08 4.60469 12.0764 4.61567C11.9573 6.08712 11.8381 7.56223 11.719 9.03368C11.5962 10.5564 11.4698 12.0754 11.3471 13.5981C11.3182 13.9824 11.2207 14.3338 10.9391 14.6157C10.7296 14.8243 10.4697 14.9305 10.1917 15C7.72557 15 5.26308 15 2.79699 15C2.78977 14.9927 2.78255 14.9854 2.77533 14.9854C2.18318 14.8975 1.70657 14.396 1.65963 13.7299C1.59102 12.7928 1.50798 11.8521 1.43215 10.9151C1.33828 9.79136 1.24801 8.6713 1.15413 7.54758C1.07109 6.51

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ui\static\media\icon_trash_white.1601c18d.svg

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):4395
                                                                                                                                                                                                                                          Entropy (8bit):3.9130769273478307
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:96:sreYdijt0XCV30iqhzz9GaHPuPVs2asmBsVG2SuMnq6Rx:saISGt95P6eRB9uidx
                                                                                                                                                                                                                                          MD5:B0F49189BE082A137803BEA947266CC9
                                                                                                                                                                                                                                          SHA1:8733164F238BB6BC95614B91715408EA54C54E57
                                                                                                                                                                                                                                          SHA-256:042BEFCC06513E3E81506FE03F28CA2986A11731A70F958D1F0CE0095924412F
                                                                                                                                                                                                                                          SHA-512:B3E007E8284E32AA9B20BE9161CE7641F7953A23104C69265ADBB8E689CE683C0FED86DE8FC682B27C10EBAD10C0A6385EC58A7450F91D8A5541F54402EFECFF
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:<svg width="13" height="15" viewBox="0 0 13 15" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M4.62038 0C5.87329 0 7.12258 0 8.37549 0C8.39354 0.00732064 8.41159 0.0183016 8.42965 0.0219619C9.02541 0.124451 9.44425 0.560029 9.51285 1.16764C9.53451 1.35798 9.51646 1.55564 9.51646 1.76061C9.59951 1.76061 9.65006 1.76061 9.70422 1.76061C10.3577 1.76061 11.0149 1.75695 11.6684 1.76061C12.3111 1.76428 12.8202 2.17057 12.9647 2.78184C13.1019 3.34919 12.8311 3.97511 12.3003 4.23499C12.127 4.31918 12.08 4.42167 12.08 4.58638C12.08 4.59736 12.08 4.60469 12.0764 4.61567C11.9573 6.08712 11.8381 7.56223 11.719 9.03368C11.5962 10.5564 11.4698 12.0754 11.3471 13.5981C11.3182 13.9824 11.2207 14.3338 10.9391 14.6157C10.7296 14.8243 10.4697 14.9305 10.1917 15C7.72557 15 5.26308 15 2.79699 15C2.78977 14.9927 2.78255 14.9854 2.77533 14.9854C2.18318 14.8975 1.70657 14.396 1.65963 13.7299C1.59102 12.7928 1.50798 11.8521 1.43215 10.9151C1.33828 9.79136 1.24801 8.6713 1.15413 7.54758C1.07109 6.51

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ui\static\media\icon_turnoff_gray.a7446394.svg

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):1858
                                                                                                                                                                                                                                          Entropy (8bit):4.054255384536267
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:24:tcoqAuJJhP7yShzrcOTpBqPmJT2cePJeSFu1uXfSVbxS6GRqkg+HqpYNOo5bASNQ:hqPY85FBgcAtu1QS8qkg+HIYZXtlkN
                                                                                                                                                                                                                                          MD5:04FDC7FEDBD2538F8B4A24EC6A737DDB
                                                                                                                                                                                                                                          SHA1:30EAAA4ECE1B1D47F846D1CF2B5B29753049335C
                                                                                                                                                                                                                                          SHA-256:E649612224E5754F9FD4A7602847F932B58BF6B24A22A36029D782FD129054CD
                                                                                                                                                                                                                                          SHA-512:18502FD6B8C17E3EE5EC89E9F9028710BB2BE57D2FB46282DDD3E7CE5C76F76FD17ECDFCC810F4B44FCE583937F10DD45C397449C374E4DBD7EFF2C12E36358C
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:<svg width="19" height="21" viewBox="0 0 19 21" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M8.896 21C8.53124 20.9487 8.16142 20.9077 7.80173 20.8359C5.14713 20.3231 3.06499 18.9233 1.56544 16.6568C0.521838 15.0826 -0.00502985 13.334 3.61876e-05 11.4418C0.0101683 8.62669 1.02844 6.24228 3.05486 4.30398C3.81983 3.57584 4.69119 3.00665 5.6436 2.57592C6.08435 2.37594 6.54536 2.50926 6.77839 2.89897C7.00636 3.27843 6.92024 3.77069 6.57069 4.03734C6.47443 4.10912 6.36298 4.16553 6.25659 4.21681C4.39229 5.10904 3.05992 6.51918 2.28482 8.45235C1.75289 9.78044 1.6009 11.1547 1.81874 12.5751C2.07711 14.2467 2.79142 15.6928 3.96168 16.8978C5.00021 17.9695 6.25153 18.6925 7.70041 19.0309C9.72683 19.5078 11.6469 19.2207 13.4352 18.1592C15.1424 17.1491 16.3127 15.6723 16.9054 13.7647C17.5893 11.57 17.3613 9.44201 16.2316 7.43705C15.416 5.98589 14.2407 4.91931 12.7411 4.21681C12.4777 4.09374 12.2446 3.93478 12.1433 3.6425C12.0268 3.31432 12.118 2.93999 12.3764 2.70411C12.6651 2.44773 1

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ui\static\media\icon_turnoff_white.333d83c8.svg

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):1854
                                                                                                                                                                                                                                          Entropy (8bit):4.069519451091226
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:24:tcoqAuJJhP7yShzrcOTpBqPmJT2cePJeSFu1uXfSVbxS6GRqkg+HqpYNOo5bAH2y:hqPY85FBgcAtu1QS8qkg+HIY1XtlkB
                                                                                                                                                                                                                                          MD5:FCA164880EE2E1D12B798C98241DCB76
                                                                                                                                                                                                                                          SHA1:A8554FA6389771ECBB7A7C5FEB016EC3DD6C056E
                                                                                                                                                                                                                                          SHA-256:5F591B87FE162601A488611DAEE8E89C6C0ABA9006DE926D75FC339224AA61E2
                                                                                                                                                                                                                                          SHA-512:90C00A580BBB8C47AB0B88A52F7738AE6F3188F3E6964D7CBB7011680C4F5406FA61EF7EA8A6403D41CA429E3FFD9FFABEF4C948DCA86782515E99A057B1CE27
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:<svg width="19" height="21" viewBox="0 0 19 21" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M8.896 21C8.53124 20.9487 8.16142 20.9077 7.80173 20.8359C5.14713 20.3231 3.06499 18.9233 1.56544 16.6568C0.521838 15.0826 -0.00502985 13.334 3.61876e-05 11.4418C0.0101683 8.62669 1.02844 6.24228 3.05486 4.30398C3.81983 3.57584 4.69119 3.00665 5.6436 2.57592C6.08435 2.37594 6.54536 2.50926 6.77839 2.89897C7.00636 3.27843 6.92024 3.77069 6.57069 4.03734C6.47443 4.10912 6.36298 4.16553 6.25659 4.21681C4.39229 5.10904 3.05992 6.51918 2.28482 8.45235C1.75289 9.78044 1.6009 11.1547 1.81874 12.5751C2.07711 14.2467 2.79142 15.6928 3.96168 16.8978C5.00021 17.9695 6.25153 18.6925 7.70041 19.0309C9.72683 19.5078 11.6469 19.2207 13.4352 18.1592C15.1424 17.1491 16.3127 15.6723 16.9054 13.7647C17.5893 11.57 17.3613 9.44201 16.2316 7.43705C15.416 5.98589 14.2407 4.91931 12.7411 4.21681C12.4777 4.09374 12.2446 3.93478 12.1433 3.6425C12.0268 3.31432 12.118 2.93999 12.3764 2.70411C12.6651 2.44773 1

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ui\static\media\icon_unpin_gray.712c1820.svg

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):2922
                                                                                                                                                                                                                                          Entropy (8bit):3.8955256034331684
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:48:qqUqL0zHerZmOk5T7f/v+8JKgmEU5BdN5gxQsAvCSEkP2ME6nwnTW5IO:qoC+rZg5vuwyVBb5gxQHvREkP2Jl8
                                                                                                                                                                                                                                          MD5:60F659C2639149E5FE452A99BA232B94
                                                                                                                                                                                                                                          SHA1:70AB8FCF7714F5C83F9C7C749E95702273CEAF11
                                                                                                                                                                                                                                          SHA-256:FA330061E57D90B2BBB6F9F24982991F574DEC5E697CBACFB2551BD6D6317CD3
                                                                                                                                                                                                                                          SHA-512:25C728806C4C1501762A1D0446D18818BDDE667FE0681074541D3C8F4F2207F8DC8AA3A5F825CDE2F79E580BBA0F6C9189BBD9C2E11D261E57D4ECA78B83405D
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:<svg width="15" height="15" viewBox="0 0 15 15" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M14.7852 5.44353C13.0198 3.71096 11.2747 1.96502 9.5161 0.225768C9.21289 -0.0752561 8.88947 -0.0752561 8.58626 0.225768C7.95964 0.841196 7.33975 1.45662 6.71986 2.07874C6.41665 2.37977 6.41665 2.69417 6.7266 3.00188C6.84788 3.12898 6.98264 3.2427 7.10392 3.36311C7.07697 3.40325 7.07023 3.42332 7.05676 3.4367C6.49077 3.99861 5.93152 4.56052 5.3588 5.10905C5.31163 5.15588 5.19709 5.17595 5.12971 5.16257C4.27399 5.00871 3.41153 4.92844 2.54234 5.04216C1.8416 5.12912 1.18802 5.34987 0.648983 5.82482C0.271659 6.16598 0.264921 6.48039 0.622032 6.83493C1.69336 7.89855 2.77143 8.96886 3.84276 10.0325C3.89667 10.086 3.94383 10.1395 4.02469 10.2198C3.88993 10.3402 3.76191 10.4472 3.64736 10.5609C2.50865 11.6915 1.3632 12.822 0.224493 13.9592C-0.0113341 14.1933 -0.0584993 14.4408 0.0695214 14.6883C0.197542 14.9291 0.453583 15.0562 0.743314 14.976C0.878073 14.9425 1.00609 14.8556 1.10716 14.75

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ui\static\media\icon_unpin_white.6b8ad10f.svg

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):2920
                                                                                                                                                                                                                                          Entropy (8bit):3.895777405127468
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:48:qqUqL0zHerZmOk5T7f/v+8JKgmEU5BdN5gxQsAvCSEkP2ME6nwnTW5Io:qoC+rZg5vuwyVBb5gxQHvREkP2Jla
                                                                                                                                                                                                                                          MD5:610CC1A8CF2F609FCD872D217E3D4333
                                                                                                                                                                                                                                          SHA1:91F5EBF7DFAA1F39123342EFF19176D4432C0388
                                                                                                                                                                                                                                          SHA-256:AC401187E858B9BD7CAD7A638063B9808FA6545D6576BBEA41471C7336E6AAE2
                                                                                                                                                                                                                                          SHA-512:E803E86F8090F205EBF3EF2E9796ECFD7B31485A89DFFA4B72785E3E721BFA67CEF2D1D8416352C320BC6556FF977FC9630A2E24551BA6CDB9965F2067B3CE28
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:<svg width="15" height="15" viewBox="0 0 15 15" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M14.7852 5.44353C13.0198 3.71096 11.2747 1.96502 9.5161 0.225768C9.21289 -0.0752561 8.88947 -0.0752561 8.58626 0.225768C7.95964 0.841196 7.33975 1.45662 6.71986 2.07874C6.41665 2.37977 6.41665 2.69417 6.7266 3.00188C6.84788 3.12898 6.98264 3.2427 7.10392 3.36311C7.07697 3.40325 7.07023 3.42332 7.05676 3.4367C6.49077 3.99861 5.93152 4.56052 5.3588 5.10905C5.31163 5.15588 5.19709 5.17595 5.12971 5.16257C4.27399 5.00871 3.41153 4.92844 2.54234 5.04216C1.8416 5.12912 1.18802 5.34987 0.648983 5.82482C0.271659 6.16598 0.264921 6.48039 0.622032 6.83493C1.69336 7.89855 2.77143 8.96886 3.84276 10.0325C3.89667 10.086 3.94383 10.1395 4.02469 10.2198C3.88993 10.3402 3.76191 10.4472 3.64736 10.5609C2.50865 11.6915 1.3632 12.822 0.224493 13.9592C-0.0113341 14.1933 -0.0584993 14.4408 0.0695214 14.6883C0.197542 14.9291 0.453583 15.0562 0.743314 14.976C0.878073 14.9425 1.00609 14.8556 1.10716 14.75

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ui\static\media\icon_weather_gray.6eb05cae.svg

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):3445
                                                                                                                                                                                                                                          Entropy (8bit):3.979453075901205
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:48:lFFqyQ7dtcTIAcq+/O53Jve2d923tqjvtLaTbVixmR/3dagOJj2xcS19kjJWtHGE:5q7HcUAT7mztiVLavIxmN3IZh2n
                                                                                                                                                                                                                                          MD5:8517A7C9AC10921DEBA471DD89A13601
                                                                                                                                                                                                                                          SHA1:55F06AA4A8E2C59CCBCF9EDFBF4A19192E921302
                                                                                                                                                                                                                                          SHA-256:4AA2937B6A751F114A1CB7BE1A09ECEC436F70AF6350A17EAFF88A3D88262818
                                                                                                                                                                                                                                          SHA-512:6EB83B5F88E0945C63550501FD856AB9E0B80C0827470124FF93342A7F8EB560CCF11AFEBC08D49F7BB55122EB6D22D0146E979D7A10F911233E17B77704DD86
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:<svg width="27" height="23" viewBox="0 0 27 23" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M26.576 17.9499C26.4889 18.2549 26.4453 18.5599 26.3582 18.8649C25.7918 20.9561 24.0056 22.5245 21.8708 22.7859C21.5223 22.8294 21.1737 22.8294 20.8252 22.8294C17.2527 22.8294 13.6367 22.8294 10.0642 22.8294C7.84227 22.8294 6.09959 21.3917 5.66392 19.257C5.44609 18.2549 5.62036 17.2529 6.14316 16.338C6.18673 16.2508 6.2303 16.2073 6.27387 16.1201C6.01247 15.9023 5.70749 15.6845 5.44609 15.4666C3.57271 13.6804 2.96277 11.502 3.70341 9.0623C4.44405 6.62255 6.18672 5.18485 8.7136 4.74918C11.3712 4.31351 13.9416 5.70765 15.1615 8.10383C15.2486 8.27809 15.3358 8.32166 15.51 8.36523C17.8191 8.5395 19.5182 9.62867 20.5202 11.6763C20.6509 11.8941 20.7381 11.9813 20.9995 11.9813C23.8313 11.9377 26.0968 13.9418 26.4889 16.7301C26.4889 16.7736 26.5325 16.8608 26.5325 16.9043C26.576 17.2529 26.576 17.6014 26.576 17.9499ZM15.5972 21.3046C16.5121 21.3046 17.4706 21.3046 18.3855 21.3046C19.3439 2

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ui\static\media\icon_weather_white.c0043930.svg

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):3425
                                                                                                                                                                                                                                          Entropy (8bit):4.01234712901125
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:48:DKJzzcgT2SgblyFVQzNrd99EGDBBIO2sOlvu0+sGD0gfDOAHmD1MjQQnfvw8aN+F:+zzcWMlyFWJO5fYdHmDufv1aNs
                                                                                                                                                                                                                                          MD5:0C92AF8318B8C3247643257AF05FD42E
                                                                                                                                                                                                                                          SHA1:2DD447FF88BC4B9BC48324FEF75D9395867D7462
                                                                                                                                                                                                                                          SHA-256:0503A1E65404853AE72D674F95D1ECB8EFCDF94B68A5B80EE8B59D7E77504A39
                                                                                                                                                                                                                                          SHA-512:C5AACD08A30E34262FA433B29EC8971CC39E4675D9186C9D527641516CBB5C70B7F3138DF3AA3BD45677B4043F89DAC981C2F16D31ACD6A80226E4E43AB6107B
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:<svg width="26" height="22" viewBox="0 0 26 22" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M26 17.2979C25.9147 17.5917 25.8721 17.8856 25.7869 18.1795C25.2328 20.1948 23.4853 21.7063 21.3968 21.9582C21.0558 22.0002 20.7149 22.0002 20.3739 22.0002C16.8789 22.0002 13.3413 22.0002 9.84631 22.0002C7.6726 22.0002 5.96772 20.6147 5.5415 18.5574C5.32839 17.5917 5.49888 16.6261 6.01034 15.7444C6.05297 15.6604 6.0956 15.6185 6.13822 15.5345C5.88249 15.3246 5.58412 15.1146 5.32839 14.9047C3.49565 13.1833 2.89895 11.0841 3.62352 8.7329C4.34809 6.38173 6.05296 4.99623 8.52503 4.57638C11.125 4.15653 13.6397 5.50005 14.8331 7.80923C14.9183 7.97717 15.0035 8.01915 15.174 8.06114C17.433 8.22908 19.0952 9.2787 20.0755 11.252C20.2034 11.4619 20.2887 11.5459 20.5444 11.5459C23.3148 11.5039 25.5311 13.4352 25.9147 16.1223C25.9147 16.1643 25.9574 16.2482 25.9574 16.2902C26 16.6261 26 16.962 26 17.2979ZM15.2593 20.5307C16.1543 20.5307 17.092 20.5307 17.9871 20.5307C18.9248 20.5307 19.8198 20.

                                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ui\static\media\in_background_auto_update_img.dd2961b8.png

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          File Type:PNG image data, 490 x 140, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):11957
                                                                                                                                                                                                                                          Entropy (8bit):7.943985153985361
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:192:jSTZR77SSlsXp7h9PKr6L1KJ9yRh/+AogjkisWttJkuzTCFvm9e4t4L6swiagy76:WJsV0e1j+AoGsWtxWqCJHHNi0
                                                                                                                                                                                                                                          MD5:5D3291D90D252B1C09C262466D67D04A
                                                                                                                                                                                                                                          SHA1:0AFB93843C13CC71B458D92E5400FC756FEC5691
                                                                                                                                                                                                                                          SHA-256:4192A0833E3F06C4B9B563BA5777A3CBFAA69BCBA6DF233889540709772FF082
                                                                                                                                                                                                                                          SHA-512:B14F315D3C3A7F7EEEB758774DCC0F3891087DCC79C2A30C61E27F401F04AFDD18D0393AA7CFA4E56A41F6F295AF0716920B313653D095ADB5CE56E18804EEE1
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:.PNG........IHDR.....................pHYs.................sRGB.........gAMA......a....JIDATx..}p..}.b......l.`...cp.p..$....M...$...6.I.o...i...N.f...L.G.M..8.f...0..,$1..........3.X....=.s........+..~f4..=.y?.w~..9.i.c.Q'..B.<2..'..B.."A-..B...j!..".HP.!..9F.Z.!..1..B.!D....B.!r....B..c$...B..#A-..B...j!..".HP.!..9F.Z.!..1..B.!D....B.!r....B..c$...B..#A-..B...j!..".HP.!..9F.Z.!..1..B.!D....B.!r....B..c$...B..#A-..B...j!..".HP.!..9F.Z.!..17...2........&wS.m..^..r..x......kC/9!..b..r..m... ..=.GA@g.j..7...I`.!..I..RP..y.k.....^....kCn.....wB.!..`...E.q9.}......q-7..z._Z|.......T0o.....7...~......+.n....Y.q.+.5....IW.O..~o.....Y...].Y....v.....~w..{.../..?..g..y...?...x..g...'....zA...o...7o..........R......W)...k........._..[{....|..?..?.Y..?......O.`.{<..j..dtt.......Q-...c_..S.Zz<G.R?.so.....H...}.I..o}....cuiy......_y.}...s---..O~5..g.wB.Q.......k..z@X.....t..._.qn.]w.A..D..<......@.,.=....>.v.u.{.....s...4..ou.>......7....o.-.X.Tz.....

                                                                                                                                                                                                                                          Chrome Cache Entry: 305

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                          File Type:HTML document, ASCII text, with very long lines (22120), with no line terminators
                                                                                                                                                                                                                                          Category:downloaded
                                                                                                                                                                                                                                          Size (bytes):22120
                                                                                                                                                                                                                                          Entropy (8bit):5.547472352786767
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:384:yotgU68rFT+l8mFM+F8X8LnFl+L+0FO08g0cEr/sL/Uj/gm/F7/Nu/y1/bN/eN/I:NRamM5GsLFQyKZ8XcU/M/I/V/1/8/E/H
                                                                                                                                                                                                                                          MD5:F802C8A6D2911B2F9FCAB5C1D3B1B311
                                                                                                                                                                                                                                          SHA1:5BF8360348464BBD6E2CBDC6CD41B0AA27DEBE2B
                                                                                                                                                                                                                                          SHA-256:A8C5F0394BA71ADC1CB6C814568F5D47ADB43C09EE0BF0A226A30E6E2FF44216
                                                                                                                                                                                                                                          SHA-512:D31CB71094D06525D22EE329299B2BB65F0B6CBAEAF8781D31253BD4B84591DB5DBAD4EC7CFA6C2D5239FA573EF57C24432F705D518A5C4DFE5782E57DA7FDBD
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          URL:https://td.doubleclick.net/td/rul/858128210?random=1730913903683&cv=11&fst=1730913903683&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4au0v9103256652za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101823848~101878899~101878944~101925629&u_w=1280&u_h=1024&url=https%3A%2F%2Fpcapp.store%2F%3Fp%3Dlpd_installing_r2%26guid%3D4D802742-3099-9C0E-C19B-2A23EA1FC420%26_fcid%3D1730911513052455%26_winver%3D19045%26version%3Dfa.1092c&hn=www.googleadservices.com&frm=0&tiba=APP%20STORE%3A%20Installing&npa=0&pscdl=noapi&auid=1971258614.1730913904&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.134%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.134&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dgtag.config
                                                                                                                                                                                                                                          Preview:<html><head><meta http-equiv="origin-trial" content="Avh5Ny0XEFCyQ7+oNieXskUrqY8edUzL5/XrwKlGjARQHW4TFRK+jVd5HnDIpY20n5OLHfgU4ku7x48N3uhG/A0AAABxeyJvcmlnaW4iOiJodHRwczovL2RvdWJsZWNsaWNrLm5ldDo0NDMiLCJmZWF0dXJlIjoiUHJpdmFjeVNhbmRib3hBZHNBUElzIiwiZXhwaXJ5IjoxNjk1MTY3OTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0="></head><body><script>var ig_list={"interestGroups":[{"action":0,"expirationTimeInSeconds":5184000,"interestGroupAttributes":{"owner":"https://td.doubleclick.net","name":"4s1971258614.1730913904","biddingLogicUrl":"https://td.doubleclick.net/td/bjs","dailyUpdateUrl":"https://td.doubleclick.net/td/update?ig_name=4s1971258614.1730913904\u0026ig_key=1sNHMxOTcxMjU4NjE0LjE3MzA5MTM5MDQ!2sZ3rAcg!3sAAptDV4h2axO","trustedBiddingSignalsUrl":"https://td.doubleclick.net/td/bts","trustedBiddingSignalsKeys":["1sWqNY8Q!2sZ3rAcg!3sAAptDV4h2axO"],"userBiddingSignals":[["7900466892","7904283812","7896384790","7904705661","475816165","596093288"],null,1730913906213295],"ads":[{"renderUrl":"https://tdsf.doublecli

                                                                                                                                                                                                                                          Chrome Cache Entry: 306

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                          File Type:ASCII text, with very long lines (4854), with no line terminators
                                                                                                                                                                                                                                          Category:downloaded
                                                                                                                                                                                                                                          Size (bytes):4854
                                                                                                                                                                                                                                          Entropy (8bit):5.83756857427928
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:96:1gWUfvlcY021mvn1blhad7OIJoodnbUp2dEjkRUcaJV39CAH:1DY0hf1bT47OIqWb15aJV39F
                                                                                                                                                                                                                                          MD5:65EAB22FCB2349DF235CD3AAA4386028
                                                                                                                                                                                                                                          SHA1:E8CCB4E73738CC5FD8C9FA9494F2755294757AA4
                                                                                                                                                                                                                                          SHA-256:80167C3F1387BD761C1D53627460A5E06396969A2A78DBE526CF4617792C66FA
                                                                                                                                                                                                                                          SHA-512:07C0870B2E58B2D35D16590F0FDE50DFA6F78A7A1D332F913397FDE8113FF8C9F13E6A368FA003A0B7B293CAE1B813763DD13B86B3E84F32B41759AE9A4BF5D3
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          URL:https://googleads.g.doubleclick.net/pagead/viewthroughconversion/858128210/?random=1730913903683&cv=11&fst=1730913903683&bg=ffffff&guid=ON&async=1&gtm=45be4au0v9103256652za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101823848~101878899~101878944~101925629&u_w=1280&u_h=1024&url=https%3A%2F%2Fpcapp.store%2F%3Fp%3Dlpd_installing_r2%26guid%3D4D802742-3099-9C0E-C19B-2A23EA1FC420%26_fcid%3D1730911513052455%26_winver%3D19045%26version%3Dfa.1092c&hn=www.googleadservices.com&frm=0&tiba=APP%20STORE%3A%20Installing&npa=0&pscdl=noapi&auid=1971258614.1730913904&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.134%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.134&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dgtag.config&rfmt=3&fmt=4
                                                                                                                                                                                                                                          Preview:(function(){var s = {};(function(){var h=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,d){if(a==Array.prototype||a==Object.prototype)return a;a[b]=d.value;return a};function k(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var d=a[b];if(d&&d.Math==Math)return d}throw Error("Cannot find global object");} var m=k(this),p=typeof Symbol==="function"&&typeof Symbol("x")==="symbol",t={},v={};function w(a,b,d){if(!d||a!=null){d=v[b];if(d==null)return a[b];d=a[d];return d!==void 0?d:a[b]}} function x(a,b,d){if(b)a:{var c=a.split(".");a=c.length===1;var e=c[0],g;!a&&e in t?g=t:g=m;for(e=0;e<c.length-1;e++){var f=c[e];if(!(f in g))break a;g=g[f]}c=c[c.length-1];d=p&&d==="es6"?g[c]:null;b=b(d);b!=null&&(a?h(t,c,{configurable:!0,writable:!0,value:b}):b!==d&&(v[c]===void 0&&(a=Math.random()*1E9>>>0,v[c]=p?m.Symbol(c):"$jscp$"+a+"$"+c),h(g,v[c],{co

                                                                                                                                                                                                                                          Chrome Cache Entry: 307

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                          File Type:ASCII text, with very long lines (14408)
                                                                                                                                                                                                                                          Category:downloaded
                                                                                                                                                                                                                                          Size (bytes):438953
                                                                                                                                                                                                                                          Entropy (8bit):5.626358931409854
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:6144:N4wGTFhCGLgB40orAzWRSR9cM8rT/o2+YUZ9Or24Avd:GwiFhjc40or6HYmYw
                                                                                                                                                                                                                                          MD5:52018B22F236F84F6263321275CC7A64
                                                                                                                                                                                                                                          SHA1:B6A811702158A84AB895CCD19A84D99FFCE02479
                                                                                                                                                                                                                                          SHA-256:1E621D6DDD8A2DF202E96C993CA9ABB6CA87ACBE1208DFF93D4F29C664CC041D
                                                                                                                                                                                                                                          SHA-512:C19E0156AD9081FA5852A449240334918325DACF32BED4DF82E57C33A2CC5DFB3E398298684D36B1AADA785E2B50DAD7F203E954CFE02FC6D5170A5A64E24F63
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          URL:https://www.googletagmanager.com/gtag/js?id=G-VFQWFX3X1C
                                                                                                                                                                                                                                          Preview:.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"3",. . "macros":[{"function":"__e"},{"function":"__c","vtp_value":""},{"function":"__c","vtp_value":0}],. "tags":[{"function":"__ogt_cross_domain","priority":39,"vtp_rules":["list","pcapp\\.store","pcappstore\\.download"],"tag_id":11},{"function":"__ogt_ga_send","priority":29,"vtp_value":true,"tag_id":13},{"function":"__ogt_referral_exclusion","priority":29,"vtp_includeConditions":["list","veryfast\\.io"],"tag_id":14},{"function":"__ogt_session_timeout","priority":29,"vtp_sessionMinutes":30,"vtp_sessionHours":0,"tag_id":15},{"function":"__ogt_1p_data_v2","priority":29,"vtp_isAutoEnabled":true,"vtp_autoCollectExclusionSelectors":["list",["map","exclusionSelector",""]],"vtp_isEnabled":true,"vtp_cityType":"CSS_SELECTOR","vtp_manualEmailEnabled":false,"vtp_firstNameType":"CSS_SELECTOR","vtp_countryType":"CSS_SELECTOR","vtp_cityValue":"","vtp_emailType":"CSS_SELECTOR","vtp_regionTy

                                                                                                                                                                                                                                          Chrome Cache Entry: 308

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                          File Type:HTML document, ASCII text, with very long lines (22134), with no line terminators
                                                                                                                                                                                                                                          Category:downloaded
                                                                                                                                                                                                                                          Size (bytes):22134
                                                                                                                                                                                                                                          Entropy (8bit):5.54843597782169
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:384:yXtgQX8LnFT+l8mFM+F8X8rFO+0+LFl08g0/5rc+LcgjcGmct7c8ucB1cQNc1NcL:xLFamM5GsRPhxW8X/pc2c0c/cNclcHc0
                                                                                                                                                                                                                                          MD5:7C9C89FCFB312C30A65895512007C947
                                                                                                                                                                                                                                          SHA1:0153896A364762AFDAD48BB9BFB71568FCC97E27
                                                                                                                                                                                                                                          SHA-256:F6C83819E8E37EDEF00F9A0D2FA32A221D8A8899E23DE6DB0AFEC8B15B172D94
                                                                                                                                                                                                                                          SHA-512:C619F4CDF5ACF098A98581EA3D4D4A252054F6ECFEAB648D28B50310F904F869002201B16CD3D577A9228847D5414AD14EB4F8E61BEF318060E1FC303BC14833
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          URL:https://td.doubleclick.net/td/rul/858128210?random=1730913903715&cv=11&fst=1730913903715&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4au0v9103256652za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101823848~101878899~101878944~101925629&u_w=1280&u_h=1024&url=https%3A%2F%2Fpcapp.store%2F%3Fp%3Dlpd_installing_r2%26guid%3D4D802742-3099-9C0E-C19B-2A23EA1FC420%26_fcid%3D1730911513052455%26_winver%3D19045%26version%3Dfa.1092c&hn=www.googleadservices.com&frm=0&tiba=APP%20STORE%3A%20Installing&npa=0&pscdl=noapi&auid=1971258614.1730913904&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.134%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.134&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dpage_view
                                                                                                                                                                                                                                          Preview:<html><head><meta http-equiv="origin-trial" content="Avh5Ny0XEFCyQ7+oNieXskUrqY8edUzL5/XrwKlGjARQHW4TFRK+jVd5HnDIpY20n5OLHfgU4ku7x48N3uhG/A0AAABxeyJvcmlnaW4iOiJodHRwczovL2RvdWJsZWNsaWNrLm5ldDo0NDMiLCJmZWF0dXJlIjoiUHJpdmFjeVNhbmRib3hBZHNBUElzIiwiZXhwaXJ5IjoxNjk1MTY3OTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0="></head><body><script>var ig_list={"interestGroups":[{"action":0,"expirationTimeInSeconds":31104000,"interestGroupAttributes":{"owner":"https://td.doubleclick.net","name":"4s1971258614.1730913904","biddingLogicUrl":"https://td.doubleclick.net/td/bjs","dailyUpdateUrl":"https://td.doubleclick.net/td/update?ig_name=4s1971258614.1730913904\u0026ig_key=1sNHMxOTcxMjU4NjE0LjE3MzA5MTM5MDQ!2saQZCcg!3sAAptDV5YSD1o","trustedBiddingSignalsUrl":"https://td.doubleclick.net/td/bts","trustedBiddingSignalsKeys":["1sWqNY8Q!2saQZCcg!3sAAptDV5YSD1o"],"userBiddingSignals":[["7904283812","7904705661","7896384790","7900466892","475816165","596093288","8552333481"],null,1730913906228593],"ads":[{"renderUrl":"https://

                                                                                                                                                                                                                                          Chrome Cache Entry: 309

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                          File Type:ASCII text, with very long lines (4870), with no line terminators
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):4870
                                                                                                                                                                                                                                          Entropy (8bit):5.844116648408143
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:96:1gWUfvlcY021mvn1blhad7OIJoodnbUp2dEjkRUEJVX9Cv:1DY0hf1bT47OIqWb1lJVX9k
                                                                                                                                                                                                                                          MD5:F1D7C638C678D4A05E1807A8EFAD8571
                                                                                                                                                                                                                                          SHA1:6D81642D01BCD644EDE85ACAC86E298157025678
                                                                                                                                                                                                                                          SHA-256:9CC3394DD546AB72C3753E16AC2929C85026193A2DE9BD3E6172EDDFE363D05F
                                                                                                                                                                                                                                          SHA-512:E93D7E6D6138255A83A81251B11C0452D88140D81DFDF6A9E8F6DE825891946DCBF20B9365CCB8B783D0DC9D6ED8B09AD794DD6E7D89F9E7057ADB9EB85F6116
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:(function(){var s = {};(function(){var h=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,d){if(a==Array.prototype||a==Object.prototype)return a;a[b]=d.value;return a};function k(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var d=a[b];if(d&&d.Math==Math)return d}throw Error("Cannot find global object");} var m=k(this),p=typeof Symbol==="function"&&typeof Symbol("x")==="symbol",t={},v={};function w(a,b,d){if(!d||a!=null){d=v[b];if(d==null)return a[b];d=a[d];return d!==void 0?d:a[b]}} function x(a,b,d){if(b)a:{var c=a.split(".");a=c.length===1;var e=c[0],g;!a&&e in t?g=t:g=m;for(e=0;e<c.length-1;e++){var f=c[e];if(!(f in g))break a;g=g[f]}c=c[c.length-1];d=p&&d==="es6"?g[c]:null;b=b(d);b!=null&&(a?h(t,c,{configurable:!0,writable:!0,value:b}):b!==d&&(v[c]===void 0&&(a=Math.random()*1E9>>>0,v[c]=p?m.Symbol(c):"$jscp$"+a+"$"+c),h(g,v[c],{co

                                                                                                                                                                                                                                          Chrome Cache Entry: 310

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                          File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                          Category:downloaded
                                                                                                                                                                                                                                          Size (bytes):3592
                                                                                                                                                                                                                                          Entropy (8bit):4.71780114350715
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:96:XlbKIGVo4FFr2s2wVix2FFCCQ86TqYeZEB:XVFCXc+ixi4lTPB
                                                                                                                                                                                                                                          MD5:0FFC071BC5AF33D2BE224CF147670471
                                                                                                                                                                                                                                          SHA1:5A7FC912A47D0531B2C95BFCB6BEAAA2248E0779
                                                                                                                                                                                                                                          SHA-256:1923EFD4718E21B882410106B6FEF7FA35C3EB2EC3C2338CD8DFF07108F25C1F
                                                                                                                                                                                                                                          SHA-512:205AF4B98312AB012BE7D7C25AC0A6D91D11C77DC3E29A9D6CC80F96A97577826079469AF16F88FE214CF0A17C70261C4AAA671FBB19EF214B91776BC3683353
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          URL:https://repository.pcapp.store/pcapp/images/front_img/lp/lpd_installing_r2/img/done_cursor_icon.svg
                                                                                                                                                                                                                                          Preview:<svg width="107" height="109" viewBox="0 0 107 109" fill="none" xmlns="http://www.w3.org/2000/svg"><g filter="url(#filter0_d_539_286)"><path d="M78.856 41.614c.048-.048.096-.048.096-.096.048-.048.048-.096.048-.143v-.192c0-.096-.048-.144-.096-.24a.84.84 0 00-.191-.239c-.048-.096-.144-.143-.24-.191-.096-.048-.191-.144-.287-.192L31.16 17.144c-.096-.048-.144-.048-.24-.096S30.777 17 30.68 17h-.574c-.096 0-.144.048-.191.096-.048.048-.096.048-.144.096-.048.047-.048.095-.096.143L28 23.8v.191l7.853 43.29c0 .144.048.24.144.336.048.096.144.191.24.287.095.096.191.192.335.24.096.047.24.143.383.143.048 0 .048 0 .096.048h.622s.048 0 .048-.048c0 0 .048 0 .048-.048h.048s.048 0 .048-.047h.048l.048-.048.047-.048 10.153-14.27L63.1 70.537l.048.048s.048 0 .048.048l.048.048s.048.048.096.048h.096c.047 0 .047.047.095.047s.048.048.096.048h.863c.048 0 .048 0 .096-.047.048 0 .048-.048.096-.048l8.476-5.986 4.214-5.603c.048-.048.048-.096.096-.144 0-.048.047-.096.047-.144v-.191c0-.048-.047-.144-.047-.192a.363.363 0

                                                                                                                                                                                                                                          Chrome Cache Entry: 311

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                          File Type:HTML document, ASCII text, with no line terminators
                                                                                                                                                                                                                                          Category:downloaded
                                                                                                                                                                                                                                          Size (bytes):13
                                                                                                                                                                                                                                          Entropy (8bit):2.7773627950641693
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:3:qVZPV:qzd
                                                                                                                                                                                                                                          MD5:C83301425B2AD1D496473A5FF3D9ECCA
                                                                                                                                                                                                                                          SHA1:941EFB7368E46B27B937D34B07FC4D41DA01B002
                                                                                                                                                                                                                                          SHA-256:B633A587C652D02386C4F16F8C6F6AAB7352D97F16367C3C40576214372DD628
                                                                                                                                                                                                                                          SHA-512:83BAFE4C888008AFDD1B72C028C7F50DEE651CA9E7D8E1B332E0BF3AA1315884155A1458A304F6E5C5627E714BF5A855A8B8D7DB3F4EB2BB2789FE2F8F6A1D83
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          URL:https://td.doubleclick.net/td/ga/rul?tid=G-VFQWFX3X1C&gacid=2133348484.1730913904&gtm=45je4au0v898645365za200zb9103256652&dma=0&gcd=13l3l3l3l1l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=101823848~101878899~101878944~101925629&z=249047129
                                                                                                                                                                                                                                          Preview:<html></html>

                                                                                                                                                                                                                                          Chrome Cache Entry: 312

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                          File Type:ASCII text, with very long lines (4951), with no line terminators
                                                                                                                                                                                                                                          Category:downloaded
                                                                                                                                                                                                                                          Size (bytes):4951
                                                                                                                                                                                                                                          Entropy (8bit):5.850433839146769
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:96:1gWUfvlcY021mvn1blhad7OIJoodnbUp2dEjkRUN4JVO9Crw:1DY0hf1bT47OIqWb1e4JVO9gw
                                                                                                                                                                                                                                          MD5:53BCAEAD17725636216013E59E133B72
                                                                                                                                                                                                                                          SHA1:091E958A5C4CBAF9817034DC1F2740907A678066
                                                                                                                                                                                                                                          SHA-256:F32B8BA76F0F91A9AC6A69A5BACCC49D1FF73A3883799546BBEF775C8D32E7CB
                                                                                                                                                                                                                                          SHA-512:B2B49BB06EF9632DC75E18A5A5218C14799EA2BB05422B881E30F96081A2B60FC298F13A5140B801BC2B8401E9D2BDE1C1D5CF894727AEA0927E98DB64F53B82
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          URL:https://googleads.g.doubleclick.net/pagead/viewthroughconversion/858128210/?random=1730913903761&cv=11&fst=1730913903761&bg=ffffff&guid=ON&async=1&gtm=45be4au0v9103256652za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101823848~101878899~101878944~101925629&u_w=1280&u_h=1024&url=https%3A%2F%2Fpcapp.store%2F%3Fp%3Dlpd_installing_r2%26guid%3D4D802742-3099-9C0E-C19B-2A23EA1FC420%26_fcid%3D1730911513052455%26_winver%3D19045%26version%3Dfa.1092c&label=kTaFCIuq0YYZENL-l5kD&hn=www.googleadservices.com&frm=0&tiba=APP%20STORE%3A%20Installing&value=1&currency_code=USD&npa=0&pscdl=noapi&auid=1971258614.1730913904&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.134%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.134&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dconversion&rfmt=3&fmt=4
                                                                                                                                                                                                                                          Preview:(function(){var s = {};(function(){var h=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,d){if(a==Array.prototype||a==Object.prototype)return a;a[b]=d.value;return a};function k(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var d=a[b];if(d&&d.Math==Math)return d}throw Error("Cannot find global object");} var m=k(this),p=typeof Symbol==="function"&&typeof Symbol("x")==="symbol",t={},v={};function w(a,b,d){if(!d||a!=null){d=v[b];if(d==null)return a[b];d=a[d];return d!==void 0?d:a[b]}} function x(a,b,d){if(b)a:{var c=a.split(".");a=c.length===1;var e=c[0],g;!a&&e in t?g=t:g=m;for(e=0;e<c.length-1;e++){var f=c[e];if(!(f in g))break a;g=g[f]}c=c[c.length-1];d=p&&d==="es6"?g[c]:null;b=b(d);b!=null&&(a?h(t,c,{configurable:!0,writable:!0,value:b}):b!==d&&(v[c]===void 0&&(a=Math.random()*1E9>>>0,v[c]=p?m.Symbol(c):"$jscp$"+a+"$"+c),h(g,v[c],{co

                                                                                                                                                                                                                                          Chrome Cache Entry: 313

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                          File Type:ASCII text, with very long lines (3969)
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):290583
                                                                                                                                                                                                                                          Entropy (8bit):5.559363468530152
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:3072:4awizDGLET70o1n0x5CptcY0/H8+ARrrOS2WrDm6DcM8rT/7jV:lGLg70oaozRiSR9cM8rT/7p
                                                                                                                                                                                                                                          MD5:D56DC476167A649105D9C72B4D0B7C6A
                                                                                                                                                                                                                                          SHA1:1D8566783848DAA8952BA8B778D4C4D83543A422
                                                                                                                                                                                                                                          SHA-256:8104832EE7713635CB79AF305A4421EBDBEBA6ADB9BFA8F6520DDF51A2D99873
                                                                                                                                                                                                                                          SHA-512:FCDC7F122C65F750A6838568B32CD450A8CE0A322F02624DC5443860E7A908FA43736A67D70EDDC2C5579676EFADAC03A154DFEAABC1B89B4AB2B9B5F5F9FAF3
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"2",. . "macros":[{"function":"__e"}],. "tags":[{"function":"__ogt_ads_datatos","priority":16,"vtp_instanceDestinationId":"AW-858128210","tag_id":16},{"function":"__ogt_cps","priority":6,"vtp_cpsMode":"ALL","tag_id":8},{"function":"__ogt_1p_data_v2","priority":6,"vtp_isAutoEnabled":true,"vtp_autoCollectExclusionSelectors":["list",["map","exclusionSelector",""]],"vtp_isEnabled":true,"vtp_cityType":"CSS_SELECTOR","vtp_manualEmailEnabled":false,"vtp_firstNameType":"CSS_SELECTOR","vtp_countryType":"CSS_SELECTOR","vtp_cityValue":"","vtp_emailType":"CSS_SELECTOR","vtp_regionType":"CSS_SELECTOR","vtp_autoEmailEnabled":true,"vtp_postalCodeValue":"","vtp_lastNameValue":"","vtp_phoneType":"CSS_SELECTOR","vtp_phoneValue":"","vtp_streetType":"CSS_SELECTOR","vtp_autoPhoneEnabled":false,"vtp_postalCodeType":"CSS_SELECTOR","vtp_emailValue":"","vtp_firstNameValue":"","vtp_streetValue":"","vtp_

                                                                                                                                                                                                                                          Chrome Cache Entry: 314

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                          File Type:ASCII text, with very long lines (3969)
                                                                                                                                                                                                                                          Category:downloaded
                                                                                                                                                                                                                                          Size (bytes):290583
                                                                                                                                                                                                                                          Entropy (8bit):5.559363468530152
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:3072:4awizDGLET70o1n0x5CptcY0/H8+ARrrOS2WrDm6DcM8rT/7jV:lGLg70oaozRiSR9cM8rT/7p
                                                                                                                                                                                                                                          MD5:D56DC476167A649105D9C72B4D0B7C6A
                                                                                                                                                                                                                                          SHA1:1D8566783848DAA8952BA8B778D4C4D83543A422
                                                                                                                                                                                                                                          SHA-256:8104832EE7713635CB79AF305A4421EBDBEBA6ADB9BFA8F6520DDF51A2D99873
                                                                                                                                                                                                                                          SHA-512:FCDC7F122C65F750A6838568B32CD450A8CE0A322F02624DC5443860E7A908FA43736A67D70EDDC2C5579676EFADAC03A154DFEAABC1B89B4AB2B9B5F5F9FAF3
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          URL:https://www.googletagmanager.com/gtag/js?id=AW-858128210
                                                                                                                                                                                                                                          Preview:.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"2",. . "macros":[{"function":"__e"}],. "tags":[{"function":"__ogt_ads_datatos","priority":16,"vtp_instanceDestinationId":"AW-858128210","tag_id":16},{"function":"__ogt_cps","priority":6,"vtp_cpsMode":"ALL","tag_id":8},{"function":"__ogt_1p_data_v2","priority":6,"vtp_isAutoEnabled":true,"vtp_autoCollectExclusionSelectors":["list",["map","exclusionSelector",""]],"vtp_isEnabled":true,"vtp_cityType":"CSS_SELECTOR","vtp_manualEmailEnabled":false,"vtp_firstNameType":"CSS_SELECTOR","vtp_countryType":"CSS_SELECTOR","vtp_cityValue":"","vtp_emailType":"CSS_SELECTOR","vtp_regionType":"CSS_SELECTOR","vtp_autoEmailEnabled":true,"vtp_postalCodeValue":"","vtp_lastNameValue":"","vtp_phoneType":"CSS_SELECTOR","vtp_phoneValue":"","vtp_streetType":"CSS_SELECTOR","vtp_autoPhoneEnabled":false,"vtp_postalCodeType":"CSS_SELECTOR","vtp_emailValue":"","vtp_firstNameValue":"","vtp_streetValue":"","vtp_

                                                                                                                                                                                                                                          Chrome Cache Entry: 315

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                          File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):3592
                                                                                                                                                                                                                                          Entropy (8bit):4.71780114350715
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:96:XlbKIGVo4FFr2s2wVix2FFCCQ86TqYeZEB:XVFCXc+ixi4lTPB
                                                                                                                                                                                                                                          MD5:0FFC071BC5AF33D2BE224CF147670471
                                                                                                                                                                                                                                          SHA1:5A7FC912A47D0531B2C95BFCB6BEAAA2248E0779
                                                                                                                                                                                                                                          SHA-256:1923EFD4718E21B882410106B6FEF7FA35C3EB2EC3C2338CD8DFF07108F25C1F
                                                                                                                                                                                                                                          SHA-512:205AF4B98312AB012BE7D7C25AC0A6D91D11C77DC3E29A9D6CC80F96A97577826079469AF16F88FE214CF0A17C70261C4AAA671FBB19EF214B91776BC3683353
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:<svg width="107" height="109" viewBox="0 0 107 109" fill="none" xmlns="http://www.w3.org/2000/svg"><g filter="url(#filter0_d_539_286)"><path d="M78.856 41.614c.048-.048.096-.048.096-.096.048-.048.048-.096.048-.143v-.192c0-.096-.048-.144-.096-.24a.84.84 0 00-.191-.239c-.048-.096-.144-.143-.24-.191-.096-.048-.191-.144-.287-.192L31.16 17.144c-.096-.048-.144-.048-.24-.096S30.777 17 30.68 17h-.574c-.096 0-.144.048-.191.096-.048.048-.096.048-.144.096-.048.047-.048.095-.096.143L28 23.8v.191l7.853 43.29c0 .144.048.24.144.336.048.096.144.191.24.287.095.096.191.192.335.24.096.047.24.143.383.143.048 0 .048 0 .096.048h.622s.048 0 .048-.048c0 0 .048 0 .048-.048h.048s.048 0 .048-.047h.048l.048-.048.047-.048 10.153-14.27L63.1 70.537l.048.048s.048 0 .048.048l.048.048s.048.048.096.048h.096c.047 0 .047.047.095.047s.048.048.096.048h.863c.048 0 .048 0 .096-.047.048 0 .048-.048.096-.048l8.476-5.986 4.214-5.603c.048-.048.048-.096.096-.144 0-.048.047-.096.047-.144v-.191c0-.048-.047-.144-.047-.192a.363.363 0

                                                                                                                                                                                                                                          Chrome Cache Entry: 316

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                          File Type:ASCII text, with very long lines (14408)
                                                                                                                                                                                                                                          Category:downloaded
                                                                                                                                                                                                                                          Size (bytes):438979
                                                                                                                                                                                                                                          Entropy (8bit):5.626410156814607
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:6144:N4wGTFhCGLgB40oJAzWRSR9cM8rT/x2+YUZ9Or24Avp:GwiFhjc40oJ6WYmYw
                                                                                                                                                                                                                                          MD5:AA69E8E937DFDF15E394891C0E6F1B59
                                                                                                                                                                                                                                          SHA1:88F82E5DB55A72E87ADBEB5430DBD74F000E5CE3
                                                                                                                                                                                                                                          SHA-256:1A6F0539EA8C0993E4FB82013B7B6F7C0153C32BE9E0D8ACC7622A2B434D23A4
                                                                                                                                                                                                                                          SHA-512:5A10E987E37A44631D708AAD832C79D7FF52C16F64641299B81FF701B1A14187A2FB6720DD1D18AD3CBA18DE9AA3EFA91BD566F14E5FAAEDF033E87BA45BA805
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          URL:https://www.googletagmanager.com/gtag/js?id=G-VFQWFX3X1C&l=dataLayer&cx=c
                                                                                                                                                                                                                                          Preview:.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"3",. . "macros":[{"function":"__e"},{"function":"__c","vtp_value":""},{"function":"__c","vtp_value":0}],. "tags":[{"function":"__ogt_cross_domain","priority":39,"vtp_rules":["list","pcapp\\.store","pcappstore\\.download"],"tag_id":11},{"function":"__ogt_ga_send","priority":29,"vtp_value":true,"tag_id":13},{"function":"__ogt_referral_exclusion","priority":29,"vtp_includeConditions":["list","veryfast\\.io"],"tag_id":14},{"function":"__ogt_session_timeout","priority":29,"vtp_sessionMinutes":30,"vtp_sessionHours":0,"tag_id":15},{"function":"__ogt_1p_data_v2","priority":29,"vtp_isAutoEnabled":true,"vtp_autoCollectExclusionSelectors":["list",["map","exclusionSelector",""]],"vtp_isEnabled":true,"vtp_cityType":"CSS_SELECTOR","vtp_manualEmailEnabled":false,"vtp_firstNameType":"CSS_SELECTOR","vtp_countryType":"CSS_SELECTOR","vtp_cityValue":"","vtp_emailType":"CSS_SELECTOR","vtp_regionTy

                                                                                                                                                                                                                                          Chrome Cache Entry: 317

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                          File Type:Web Open Font Format (Version 2), TrueType, length 48444, version 1.0
                                                                                                                                                                                                                                          Category:downloaded
                                                                                                                                                                                                                                          Size (bytes):48444
                                                                                                                                                                                                                                          Entropy (8bit):7.995593685409469
                                                                                                                                                                                                                                          Encrypted:true
                                                                                                                                                                                                                                          SSDEEP:768:dn0V9qZpy/4pR+9MzTCGXckDohHxCc/TfZQEh9UONYyPYcABoN/8rZujvB:dn0+rAmWUMooVrbZQE7NYyzABK8rQ1
                                                                                                                                                                                                                                          MD5:8E433C0592F77BEB6DC527D7B90BE120
                                                                                                                                                                                                                                          SHA1:D7402416753AE1BB4CBD4B10D33A0C10517838BD
                                                                                                                                                                                                                                          SHA-256:F052EE44C3728DFD23ABA8A4567150BC314D23903026FBB6AD089422C2DF56AF
                                                                                                                                                                                                                                          SHA-512:5E90F48B923BB95AEB49691D03DADE8825C119B2FA28977EA170C41548900F4E0165E2869F97C7A9380D7FF8FF331A1DA855500E5F7B0DFD2B9ABD77A386BBF3
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          URL:https://fonts.gstatic.com/s/inter/v18/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7.woff2
                                                                                                                                                                                                                                          Preview:wOF2.......<.......l..............................`...\..p?HVAR.m?MVAR^.`?STAT.N'&..>/l........>....0....6.$.... ........[..A.2v.6......$..e...w"../.L.p:......Tpc..8@.[5......d#d.xw..o.O3-.....%..>...%..)~p.K.J.H..S...s..z..Wa.. 0\..J.....BL;V..-.L...j....^.9..HO l..,.*.6.v....?....x.....m..;....a![zif...Ur...Q..P.&.I1..:n.p...j~..h...9.!....@.<.bl|.Y?h..B.j/..rH.S%/~.^D...6..D.4G...y....Y.....=/o..W..5ryo.d?.gA]..?...1V..S......7ZJ...f....mBG[0eW....y..%B}..]? ...,sR<.y~.~.}.%.!..,X.....`...R..^....S.....u*.?k.v.k..U.u..M..`!...b!..X)P...y{.........n..T+6...R......L...x}...g...].g"WT.b..h ....X...=;{w...QO.s..w..@.(,..........{.........1..@...(...\.......9*..2.h9P.G........K.Dp...F..4W..ui.u...G...s..x7.?..tg..D..O.sA..t.t.4..~..e\...X.....T..kf.qfX..=^_....g"....De...x[J..A..).G.YUhR.....0.l..#&3.'.K..*...........$I.Pp.../.s.<@...r=..S......d..P.S.B.w.~X..ZK....h J.`A.bv,=.....>1.Ev.^..U.A. ....EU..].........dw..!$.A`..B.._.....Z~..!..J..l]r.m}m..

                                                                                                                                                                                                                                          Chrome Cache Entry: 318

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                          File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):2118
                                                                                                                                                                                                                                          Entropy (8bit):4.907323279161229
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:48:P8LlLU20REEalwVtWMhiiA379OC0WGKwKNHOLRcVIK0:ULtU2A8lwVtW+3ALKczI5
                                                                                                                                                                                                                                          MD5:1039640CF0666A1621D55C9E9FA81439
                                                                                                                                                                                                                                          SHA1:A7E6A6AB233DAE1776506F2E6C7FD03E46E83EA9
                                                                                                                                                                                                                                          SHA-256:4455C2A26901C4D348E194B06B06908C155E6459CF5987984D03848E30964F0C
                                                                                                                                                                                                                                          SHA-512:F9324B6C58C51DC3F24BD242EADA7E5565B60E12863EC13F28D883028791AEC7EC5E324298FA0427AD1CD45BDD7260FF0295DC171F24DD0AC3F0203FB6CD0706
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:<svg width="132" height="132" viewBox="0 0 132 132" fill="none" xmlns="http://www.w3.org/2000/svg"><g filter="url(#filter0_d_539_279)"><path d="M16 12.5A4.5 4.5 0 0120.5 8h91a4.5 4.5 0 014.5 4.5v91a4.5 4.5 0 01-4.5 4.5h-91a4.5 4.5 0 01-4.5-4.5v-91z" fill="#fff"/></g><path d="M81.894 54.233H67.64c-.913 0-.913 0-.913-.865V32.733c0-.865 0-.845.85-.966 3.341-.463 6.661-.946 10.002-1.41 3.839-.543 7.657-1.066 11.496-1.59 2.345-.322 4.69-.664 7.014-.986 1.037-.14 1.037-.14 1.037.866v24.6c0 .986 0 .986-1.016.986H81.894zm.021 5.841h14.422c.767 0 .767 0 .767.765v24.963c0 .845 0 .865-.871.745-3.32-.463-6.64-.947-9.94-1.41-2.282-.322-4.586-.624-6.868-.946-2.801-.382-5.603-.785-8.404-1.187-1.204-.161-2.386-.363-3.59-.484-.54-.06-.705-.261-.705-.764.02-4.067.02-8.113.02-12.18v-8.898c0-.463.146-.604.623-.604 4.814.02 9.69 0 14.546 0zm-34.175.001h12.243c.705 0 .705 0 .705.704v19.669c0 .825-.041.825-.892.704-2.47-.342-4.918-.684-7.387-1.026-2.158-.303-4.316-.625-6.454-.927-2.448-.342-4.897-.664-7.345-

                                                                                                                                                                                                                                          Chrome Cache Entry: 319

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                          File Type:HTML document, ASCII text, with very long lines (22134), with no line terminators
                                                                                                                                                                                                                                          Category:downloaded
                                                                                                                                                                                                                                          Size (bytes):22134
                                                                                                                                                                                                                                          Entropy (8bit):5.54836609288608
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:384:yXtgQ/8LnFO+08XFT+l8r8mFM+F+LFl0FU0/5r8hL89Cj8tm8078Nu8A18IN8HNQ:ZLFPX1am4M5wxWFb/p818k8I8c888C80
                                                                                                                                                                                                                                          MD5:B9B10E7E5EC651F841A7F035B2AB1D01
                                                                                                                                                                                                                                          SHA1:73D1CDCE11022E5435B96052F4F89553827B622A
                                                                                                                                                                                                                                          SHA-256:21DDD81FCF161C7897E73043006F058F87498570D186A362E7ABD0A09E753501
                                                                                                                                                                                                                                          SHA-512:DA16507C28F35EE8C3EC426C877F303AF599D5197A4687424B9514691120F270EDF920D3428AEB23E49527FABB063A3D7D2FF5AD0C1CB6838B0726F3ED392FAF
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          URL:https://td.doubleclick.net/td/rul/858128210?random=1730913903761&cv=11&fst=1730913903761&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4au0v9103256652za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101823848~101878899~101878944~101925629&u_w=1280&u_h=1024&url=https%3A%2F%2Fpcapp.store%2F%3Fp%3Dlpd_installing_r2%26guid%3D4D802742-3099-9C0E-C19B-2A23EA1FC420%26_fcid%3D1730911513052455%26_winver%3D19045%26version%3Dfa.1092c&label=kTaFCIuq0YYZENL-l5kD&hn=www.googleadservices.com&frm=0&tiba=APP%20STORE%3A%20Installing&value=1&currency_code=USD&npa=0&pscdl=noapi&auid=1971258614.1730913904&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.134%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.134&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dconversion
                                                                                                                                                                                                                                          Preview:<html><head><meta http-equiv="origin-trial" content="Avh5Ny0XEFCyQ7+oNieXskUrqY8edUzL5/XrwKlGjARQHW4TFRK+jVd5HnDIpY20n5OLHfgU4ku7x48N3uhG/A0AAABxeyJvcmlnaW4iOiJodHRwczovL2RvdWJsZWNsaWNrLm5ldDo0NDMiLCJmZWF0dXJlIjoiUHJpdmFjeVNhbmRib3hBZHNBUElzIiwiZXhwaXJ5IjoxNjk1MTY3OTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0="></head><body><script>var ig_list={"interestGroups":[{"action":0,"expirationTimeInSeconds":31104000,"interestGroupAttributes":{"owner":"https://td.doubleclick.net","name":"4s1971258614.1730913904","biddingLogicUrl":"https://td.doubleclick.net/td/bjs","dailyUpdateUrl":"https://td.doubleclick.net/td/update?ig_name=4s1971258614.1730913904\u0026ig_key=1sNHMxOTcxMjU4NjE0LjE3MzA5MTM5MDQ!2saQZCcg!3sAAptDV5YSD1o","trustedBiddingSignalsUrl":"https://td.doubleclick.net/td/bts","trustedBiddingSignalsKeys":["1sWqNY8Q!2saQZCcg!3sAAptDV5YSD1o"],"userBiddingSignals":[["596093288","7896384790","475816165","7904283812","8552333481","7900466892","7904705661"],null,1730913906229572],"ads":[{"renderUrl":"https://

                                                                                                                                                                                                                                          Chrome Cache Entry: 320

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                                          Category:downloaded
                                                                                                                                                                                                                                          Size (bytes):2499
                                                                                                                                                                                                                                          Entropy (8bit):5.4636477793325495
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:48:ejO4aAujO4aFuFZjjO4aNjO4a73rjO4awNjO4aQJc+uXjO4aWN0xD:aO4aAqO4aEFZHO4adO4a73vO4aoO4aQt
                                                                                                                                                                                                                                          MD5:382991778933FB8F5697DEB2EE26A0ED
                                                                                                                                                                                                                                          SHA1:6CDED0C76F01EA3C3C6DB8128B5CF59063A92C78
                                                                                                                                                                                                                                          SHA-256:0919FF36779EEF85FA50AF4B94FB2D496A765612B7C5EDD31BA69EA1F4136736
                                                                                                                                                                                                                                          SHA-512:FC05BAFD9EB747B7060B8C730E8A467CFD0A0311622B325E5EB74A1083D3A7B8897396CF4FE310E7567EAA1B5A951AB3906F57E57671F2852A18ED1AD0E7E2C9
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          URL:https://fonts.googleapis.com/css2?family=Inter:wght@100..900&display=swap
                                                                                                                                                                                                                                          Preview:/* cyrillic-ext */.@font-face {. font-family: 'Inter';. font-style: normal;. font-weight: 100 900;. font-display: swap;. src: url(https://fonts.gstatic.com/s/inter/v18/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa2JL7SUc.woff2) format('woff2');. unicode-range: U+0460-052F, U+1C80-1C8A, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;.}./* cyrillic */.@font-face {. font-family: 'Inter';. font-style: normal;. font-weight: 100 900;. font-display: swap;. src: url(https://fonts.gstatic.com/s/inter/v18/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa0ZL7SUc.woff2) format('woff2');. unicode-range: U+0301, U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;.}./* greek-ext */.@font-face {. font-family: 'Inter';. font-style: normal;. font-weight: 100 900;. font-display: swap;. src: url(https://fonts.gstatic.com/s/inter/v18/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa2ZL7SUc.woff2) format('woff2');. unicode-range: U+1F00-1FFF;.}./* greek */.@font-face {. font-family: 'Inter';. font-style: normal;. font-weight: 100 900;. f

                                                                                                                                                                                                                                          Chrome Cache Entry: 321

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                          File Type:ASCII text, with very long lines (4970), with no line terminators
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):4970
                                                                                                                                                                                                                                          Entropy (8bit):5.862014962939367
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:96:1gWUfvlcY021mvn1blhad7OIJoodnbUp2dEjkRUN4JVO9Cr/5:1DY0hf1bT47OIqWb1e4JVO9g/5
                                                                                                                                                                                                                                          MD5:D3D9D60005FD0F522CC700B71FE841A6
                                                                                                                                                                                                                                          SHA1:462A86B49CC58236DCE6228CCFDD2653CE861569
                                                                                                                                                                                                                                          SHA-256:1B85D1989DD90BD977264A0C894CE0D5302C215EEFA1A9B5B8502C956DBD7785
                                                                                                                                                                                                                                          SHA-512:90CFC6D8288CA2A610D33C92908F13D90062A23CFEE99B9091E2F0867981A0D28AA42D91D8EBDF3C2605D1B54474256EDE2A71F54BAED76CBB9981CA26E093A6
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:(function(){var s = {};(function(){var h=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,d){if(a==Array.prototype||a==Object.prototype)return a;a[b]=d.value;return a};function k(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var d=a[b];if(d&&d.Math==Math)return d}throw Error("Cannot find global object");} var m=k(this),p=typeof Symbol==="function"&&typeof Symbol("x")==="symbol",t={},v={};function w(a,b,d){if(!d||a!=null){d=v[b];if(d==null)return a[b];d=a[d];return d!==void 0?d:a[b]}} function x(a,b,d){if(b)a:{var c=a.split(".");a=c.length===1;var e=c[0],g;!a&&e in t?g=t:g=m;for(e=0;e<c.length-1;e++){var f=c[e];if(!(f in g))break a;g=g[f]}c=c[c.length-1];d=p&&d==="es6"?g[c]:null;b=b(d);b!=null&&(a?h(t,c,{configurable:!0,writable:!0,value:b}):b!==d&&(v[c]===void 0&&(a=Math.random()*1E9>>>0,v[c]=p?m.Symbol(c):"$jscp$"+a+"$"+c),h(g,v[c],{co

                                                                                                                                                                                                                                          Chrome Cache Entry: 322

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                          File Type:HTML document, ASCII text, with very long lines (815)
                                                                                                                                                                                                                                          Category:downloaded
                                                                                                                                                                                                                                          Size (bytes):3501
                                                                                                                                                                                                                                          Entropy (8bit):5.383873370647921
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:96:EI5cZUiKliCJ86U+QTEVWfeLwTauSEegdkZ5edOIC:EI5hiWNJ8kQTEVWfeUauRfdkZ5edO1
                                                                                                                                                                                                                                          MD5:147FD3B00C22BA9C939712E9213C24CA
                                                                                                                                                                                                                                          SHA1:3B48369B86FA0574F35379AACD1F42CC9C98A52B
                                                                                                                                                                                                                                          SHA-256:70F5B11C1870CF90201A6D5F770CA318A3FA5827C74A8765EDE22B487F7D4532
                                                                                                                                                                                                                                          SHA-512:E8419A71232EDAC8FD131446777F7D034B3171EFE07B3267479B439E4982650DB65A0D1DDC9F516315D5ED1B01ECFD2F7EB55D75D44AA51EE0AD494D441586D2
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          URL:https://www.googletagmanager.com/static/service_worker/4al0/sw_iframe.html?origin=https%3A%2F%2Fpcapp.store
                                                                                                                                                                                                                                          Preview:<!DOCTYPE html>.<html>.<head>. <link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon">.</head>.<body>. <script>.'use strict';class m{constructor(a){this.j=a;this.g={};this.h={};this.i=0;this.id=String(Math.floor(Number.MAX_SAFE_INTEGER*Math.random()))}}function n(a){return a.performance&&a.performance.now()||Date.now()}.var p=function(a,b){class d{constructor(c,g,f){this.failureType=c;this.data=g;this.g=f;this.h=new m(n(f))}s(c,g){const f=c.clientId;if(c.type===0){c.isDead=!0;var e=this.h,h=n(this.g);e.g[f]==null&&(e.g[f]=0,e.h[f]=h,e.i++);e.g[f]++;c.stats={targetId:e.id,clientCount:e.i,totalLifeMs:Math.round(h-e.j),heartbeatCount:e.g[f],clientLifeMs:Math.round(h-e.h[f])}}c.failure={failureType:this.failureType,data:this.data};g(c)}}return new d(5,a,b)};/*.. Copyright Google LLC. SPDX-License-Identifier: Apache-2.0.*/.let q=globalThis.trustedTypes,r;function t(){let a=null;if(!q)return a;try{const b=d=>d;a=q.createPolicy("goog#html",{createHTML:b,createScript:b,crea

                                                                                                                                                                                                                                          Chrome Cache Entry: 323

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                          File Type:ASCII text, with very long lines (4873), with no line terminators
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):4873
                                                                                                                                                                                                                                          Entropy (8bit):5.839114384755205
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:96:1gWUfvlcY021mvn1blhad7OIJoodnbUp2dEjkRUcaJV39CM:1DY0hf1bT47OIqWb15aJV39Z
                                                                                                                                                                                                                                          MD5:FF3BEC02C2E7DE63BAA9557ACDC68CBB
                                                                                                                                                                                                                                          SHA1:BD32F097FD675FB258818B7366207BE3C1D05064
                                                                                                                                                                                                                                          SHA-256:2693B603D8B8096EC0B44E691E31A524247E9E5CE114297C4175AAA3944FB3EF
                                                                                                                                                                                                                                          SHA-512:EB1C858F7B4A0BC12809F6553A8BFBD4C866FFFD3AED07FD0409088A454E1EE734C5DE2ED8AB8A9E5D2F1618C3EA3BBFECCCBE1C78A2BAF65E3E18B061ACEC6A
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:(function(){var s = {};(function(){var h=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,d){if(a==Array.prototype||a==Object.prototype)return a;a[b]=d.value;return a};function k(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var d=a[b];if(d&&d.Math==Math)return d}throw Error("Cannot find global object");} var m=k(this),p=typeof Symbol==="function"&&typeof Symbol("x")==="symbol",t={},v={};function w(a,b,d){if(!d||a!=null){d=v[b];if(d==null)return a[b];d=a[d];return d!==void 0?d:a[b]}} function x(a,b,d){if(b)a:{var c=a.split(".");a=c.length===1;var e=c[0],g;!a&&e in t?g=t:g=m;for(e=0;e<c.length-1;e++){var f=c[e];if(!(f in g))break a;g=g[f]}c=c[c.length-1];d=p&&d==="es6"?g[c]:null;b=b(d);b!=null&&(a?h(t,c,{configurable:!0,writable:!0,value:b}):b!==d&&(v[c]===void 0&&(a=Math.random()*1E9>>>0,v[c]=p?m.Symbol(c):"$jscp$"+a+"$"+c),h(g,v[c],{co

                                                                                                                                                                                                                                          Chrome Cache Entry: 324

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                          File Type:ASCII text, with very long lines (4853), with no line terminators
                                                                                                                                                                                                                                          Category:downloaded
                                                                                                                                                                                                                                          Size (bytes):4853
                                                                                                                                                                                                                                          Entropy (8bit):5.839471957097608
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:96:1gWUfvlcY021mvn1blhad7OIJoodnbUp2dEjkRUEJVX9CVH:1DY0hf1bT47OIqWb1lJVX98
                                                                                                                                                                                                                                          MD5:25DA3D7EDFCEB7B203656972F3B00C56
                                                                                                                                                                                                                                          SHA1:BF1C6FB9D20A56A99437FE2F70BDC5CA78907394
                                                                                                                                                                                                                                          SHA-256:F1B0B97E86B4A5E02CA81A0097616CC7335A76F2276C9A2FC7DC89EFE4FE8A95
                                                                                                                                                                                                                                          SHA-512:6531DBF793E42AD063F9B3F9FC34AFC890E6BD09064C5955273F1E1F376367FA9F104BD26B375645441E9B85167A5E265829D9A66DFA2899FB14098040E08753
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          URL:https://googleads.g.doubleclick.net/pagead/viewthroughconversion/858128210/?random=1730913903715&cv=11&fst=1730913903715&bg=ffffff&guid=ON&async=1&gtm=45be4au0v9103256652za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101823848~101878899~101878944~101925629&u_w=1280&u_h=1024&url=https%3A%2F%2Fpcapp.store%2F%3Fp%3Dlpd_installing_r2%26guid%3D4D802742-3099-9C0E-C19B-2A23EA1FC420%26_fcid%3D1730911513052455%26_winver%3D19045%26version%3Dfa.1092c&hn=www.googleadservices.com&frm=0&tiba=APP%20STORE%3A%20Installing&npa=0&pscdl=noapi&auid=1971258614.1730913904&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.134%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.134&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dpage_view&rfmt=3&fmt=4
                                                                                                                                                                                                                                          Preview:(function(){var s = {};(function(){var h=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,d){if(a==Array.prototype||a==Object.prototype)return a;a[b]=d.value;return a};function k(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var d=a[b];if(d&&d.Math==Math)return d}throw Error("Cannot find global object");} var m=k(this),p=typeof Symbol==="function"&&typeof Symbol("x")==="symbol",t={},v={};function w(a,b,d){if(!d||a!=null){d=v[b];if(d==null)return a[b];d=a[d];return d!==void 0?d:a[b]}} function x(a,b,d){if(b)a:{var c=a.split(".");a=c.length===1;var e=c[0],g;!a&&e in t?g=t:g=m;for(e=0;e<c.length-1;e++){var f=c[e];if(!(f in g))break a;g=g[f]}c=c[c.length-1];d=p&&d==="es6"?g[c]:null;b=b(d);b!=null&&(a?h(t,c,{configurable:!0,writable:!0,value:b}):b!==d&&(v[c]===void 0&&(a=Math.random()*1E9>>>0,v[c]=p?m.Symbol(c):"$jscp$"+a+"$"+c),h(g,v[c],{co

                                                                                                                                                                                                                                          Chrome Cache Entry: 325

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                          File Type:ASCII text, with very long lines (14408)
                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                          Size (bytes):438953
                                                                                                                                                                                                                                          Entropy (8bit):5.6263711707262
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:6144:N4wGTFhCGLgB40ofAzWRSR9cM8rT/o2+YUZ9Or24Avd:GwiFhjc40of6HYmYw
                                                                                                                                                                                                                                          MD5:462E9964DD611AA66D1DA74A10C25FFF
                                                                                                                                                                                                                                          SHA1:6E3FA7EA59B8CA9CF60FA645C6777AA5240826A7
                                                                                                                                                                                                                                          SHA-256:B7F370A0CFE550E35169F966AAE5426552649BE0CD50C27B96419751A9C302DA
                                                                                                                                                                                                                                          SHA-512:7FCD71C413FB17F0D6561CAA725FB11BEFEA1D8D742905B51C158D20106C868FDE9FA24FC91F3D1CB5D689E0309256FC5AE036CB29DE0B5DE797567C7DA9B0C1
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          Preview:.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"3",. . "macros":[{"function":"__e"},{"function":"__c","vtp_value":""},{"function":"__c","vtp_value":0}],. "tags":[{"function":"__ogt_cross_domain","priority":39,"vtp_rules":["list","pcapp\\.store","pcappstore\\.download"],"tag_id":11},{"function":"__ogt_ga_send","priority":29,"vtp_value":true,"tag_id":13},{"function":"__ogt_referral_exclusion","priority":29,"vtp_includeConditions":["list","veryfast\\.io"],"tag_id":14},{"function":"__ogt_session_timeout","priority":29,"vtp_sessionMinutes":30,"vtp_sessionHours":0,"tag_id":15},{"function":"__ogt_1p_data_v2","priority":29,"vtp_isAutoEnabled":true,"vtp_autoCollectExclusionSelectors":["list",["map","exclusionSelector",""]],"vtp_isEnabled":true,"vtp_cityType":"CSS_SELECTOR","vtp_manualEmailEnabled":false,"vtp_firstNameType":"CSS_SELECTOR","vtp_countryType":"CSS_SELECTOR","vtp_cityValue":"","vtp_emailType":"CSS_SELECTOR","vtp_regionTy

                                                                                                                                                                                                                                          Chrome Cache Entry: 326

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                          File Type:ASCII text, with very long lines (723)
                                                                                                                                                                                                                                          Category:downloaded
                                                                                                                                                                                                                                          Size (bytes):7076
                                                                                                                                                                                                                                          Entropy (8bit):5.52488676121649
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:192:bttd4a6O1T6ahNU3dJ+SrM0hjUYIW2WX8ISlY:bBJ1T9UNJ+SrM0lXV2WXXSlY
                                                                                                                                                                                                                                          MD5:88A2E0A522036C0B87E03552E56629AA
                                                                                                                                                                                                                                          SHA1:EC9D1157518E753A84DBDE1333A29B34CF776D63
                                                                                                                                                                                                                                          SHA-256:788AFB96F2DA68E8729EC35F3D5E381FAD3482D37C54C2195C7311440EE4C27E
                                                                                                                                                                                                                                          SHA-512:44B953878BD650FE2BCC8B6904620955C3E396B7DC8F41F85D021A8E0404DA41DB15C5499A03F7D4FE9129BB340AA3F6782942CF5327502FD4569BEBBB17073F
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          URL:https://www.googletagmanager.com/static/service_worker/4al0/sw.js?origin=https%3A%2F%2Fpcapp.store
                                                                                                                                                                                                                                          Preview:'use strict';var k=function(a){function b(c){return a.next(c)}function e(c){return a.throw(c)}return new Promise(function(c,d){function f(h){h.done?c(h.value):Promise.resolve(h.value).then(b,e).then(f,d)}f(a.next())})};/*.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0.*/.var m=this||self;var u,v;a:{for(var x=["CLOSURE_FLAGS"],B=m,C=0;C<x.length;C++)if(B=B[x[C]],B==null){v=null;break a}v=B}var G=v&&v[610401301];u=G!=null?G:!1;var H;const I=m.navigator;H=I?I.userAgentData||null:null;function J(a){return u?H?H.brands.some(({brand:b})=>b&&b.indexOf(a)!=-1):!1:!1}function K(a){var b;a:{const e=m.navigator;if(e){const c=e.userAgent;if(c){b=c;break a}}b=""}return b.indexOf(a)!=-1};function L(){return u?!!H&&H.brands.length>0:!1}function O(){return L()?J("Chromium"):(K("Chrome")||K("CriOS"))&&!(L()?0:K("Edge"))||K("Silk")};!K("Android")||O();O();!K("Safari")||O()||(L()?0:K("Coast"))||(L()?0:K("Opera"))||(L()?0:K("Edge"))||(L()?J("Microsoft Edge"):K("Edg/"))||L()&

                                                                                                                                                                                                                                          Chrome Cache Entry: 327

                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                          File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                          Category:downloaded
                                                                                                                                                                                                                                          Size (bytes):2118
                                                                                                                                                                                                                                          Entropy (8bit):4.907323279161229
                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                          SSDEEP:48:P8LlLU20REEalwVtWMhiiA379OC0WGKwKNHOLRcVIK0:ULtU2A8lwVtW+3ALKczI5
                                                                                                                                                                                                                                          MD5:1039640CF0666A1621D55C9E9FA81439
                                                                                                                                                                                                                                          SHA1:A7E6A6AB233DAE1776506F2E6C7FD03E46E83EA9
                                                                                                                                                                                                                                          SHA-256:4455C2A26901C4D348E194B06B06908C155E6459CF5987984D03848E30964F0C
                                                                                                                                                                                                                                          SHA-512:F9324B6C58C51DC3F24BD242EADA7E5565B60E12863EC13F28D883028791AEC7EC5E324298FA0427AD1CD45BDD7260FF0295DC171F24DD0AC3F0203FB6CD0706
                                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                                          URL:https://repository.pcapp.store/pcapp/images/front_img/lp/lpd_installing_r2/img/done_windows_icon.svg
                                                                                                                                                                                                                                          Preview:<svg width="132" height="132" viewBox="0 0 132 132" fill="none" xmlns="http://www.w3.org/2000/svg"><g filter="url(#filter0_d_539_279)"><path d="M16 12.5A4.5 4.5 0 0120.5 8h91a4.5 4.5 0 014.5 4.5v91a4.5 4.5 0 01-4.5 4.5h-91a4.5 4.5 0 01-4.5-4.5v-91z" fill="#fff"/></g><path d="M81.894 54.233H67.64c-.913 0-.913 0-.913-.865V32.733c0-.865 0-.845.85-.966 3.341-.463 6.661-.946 10.002-1.41 3.839-.543 7.657-1.066 11.496-1.59 2.345-.322 4.69-.664 7.014-.986 1.037-.14 1.037-.14 1.037.866v24.6c0 .986 0 .986-1.016.986H81.894zm.021 5.841h14.422c.767 0 .767 0 .767.765v24.963c0 .845 0 .865-.871.745-3.32-.463-6.64-.947-9.94-1.41-2.282-.322-4.586-.624-6.868-.946-2.801-.382-5.603-.785-8.404-1.187-1.204-.161-2.386-.363-3.59-.484-.54-.06-.705-.261-.705-.764.02-4.067.02-8.113.02-12.18v-8.898c0-.463.146-.604.623-.604 4.814.02 9.69 0 14.546 0zm-34.175.001h12.243c.705 0 .705 0 .705.704v19.669c0 .825-.041.825-.892.704-2.47-.342-4.918-.684-7.387-1.026-2.158-.303-4.316-.625-6.454-.927-2.448-.342-4.897-.664-7.345-

                                                                                                                                                                                                                                          Static File Info

                                                                                                                                                                                                                                          General

                                                                                                                                                                                                                                          File type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                                                                                                                                                                                                                                          Entropy (8bit):7.612745424395439
                                                                                                                                                                                                                                          TrID:
                                                                                                                                                                                                                                          • Win32 Executable (generic) a (10002005/4) 99.96%
                                                                                                                                                                                                                                          • Generic Win/DOS Executable (2004/3) 0.02%
                                                                                                                                                                                                                                          • DOS Executable Generic (2002/1) 0.02%
                                                                                                                                                                                                                                          • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                                                                                                                                                                          File name:Setup.exe
                                                                                                                                                                                                                                          File size:190'056 bytes
                                                                                                                                                                                                                                          MD5:5df7ccb72d4007e7fae710495b42de76
                                                                                                                                                                                                                                          SHA1:0e38df6c075e5de92be6b99249d236089dac8d5b
                                                                                                                                                                                                                                          SHA256:6c3e4398e3d563746b928bf359468f6baf416bf3f757ca789cdf7fab1f02a1b7
                                                                                                                                                                                                                                          SHA512:5354d678e7fe2b777b847d1614fb7de05fa32025d4a4b616c68b985b64129f12c1d84769404ff72380340c4b8c61b7fda58ba109aa8cddbbdb7ce108141dd449
                                                                                                                                                                                                                                          SSDEEP:3072:UbG7N2kDTHUpouL4Ynd86Pzy5n+/mGCK8izuG2okB2h4l591BBgkXmUa:UbE/HUzRe6ry5nmQiiGz4z9TJXra
                                                                                                                                                                                                                                          TLSH:7004F15056E0C862D8A28B71B5797F7B8AB5DC2192B04F8313107B187E7DE819F0E3A3
                                                                                                                                                                                                                                          File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf.*_9..Pf..Pg.LPf.*_;..Pf..sV..Pf..V`..Pf.Rich.Pf.........................PE..L...Z.Oa.................j.........

                                                                                                                                                                                                                                          File Icon

                                                                                                                                                                                                                                          Icon Hash:45d44c7192498005

                                                                                                                                                                                                                                          Static PE Info

                                                                                                                                                                                                                                          General

                                                                                                                                                                                                                                          Entrypoint:0x40352d
                                                                                                                                                                                                                                          Entrypoint Section:.text
                                                                                                                                                                                                                                          Digitally signed:true
                                                                                                                                                                                                                                          Imagebase:0x400000
                                                                                                                                                                                                                                          Subsystem:windows gui
                                                                                                                                                                                                                                          Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
                                                                                                                                                                                                                                          DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                                                                                                                                                                                                                                          Time Stamp:0x614F9B5A [Sat Sep 25 21:57:46 2021 UTC]
                                                                                                                                                                                                                                          TLS Callbacks:
                                                                                                                                                                                                                                          CLR (.Net) Version:
                                                                                                                                                                                                                                          OS Version Major:4
                                                                                                                                                                                                                                          OS Version Minor:0
                                                                                                                                                                                                                                          File Version Major:4
                                                                                                                                                                                                                                          File Version Minor:0
                                                                                                                                                                                                                                          Subsystem Version Major:4
                                                                                                                                                                                                                                          Subsystem Version Minor:0
                                                                                                                                                                                                                                          Import Hash:56a78d55f3f7af51443e58e0ce2fb5f6

                                                                                                                                                                                                                                          Authenticode Signature

                                                                                                                                                                                                                                          Signature Valid:true
                                                                                                                                                                                                                                          Signature Issuer:CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
                                                                                                                                                                                                                                          Signature Validation Error:The operation completed successfully
                                                                                                                                                                                                                                          Error Number:0
                                                                                                                                                                                                                                          Not Before, Not After
                                                                                                                                                                                                                                          • 08/05/2024 02:00:00 14/02/2025 00:59:59
                                                                                                                                                                                                                                          Subject Chain
                                                                                                                                                                                                                                          • CN=FAST CORPORATION LTD, O=FAST CORPORATION LTD, L=Ra'anana, C=IL, SERIALNUMBER=515636181, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.3=IL
                                                                                                                                                                                                                                          Version:3
                                                                                                                                                                                                                                          Thumbprint MD5:04786BD703B906E22AECB2AD38CE4D94
                                                                                                                                                                                                                                          Thumbprint SHA-1:07BE42727905BE32C822A638502C1B8FAAE6540A
                                                                                                                                                                                                                                          Thumbprint SHA-256:FDB017BB88E5D453E22A73810690C72534F58EFB109EA0D4494EC393F2307DBC
                                                                                                                                                                                                                                          Serial:0E5C655E1CBE9A8879372F58A5BC0302

                                                                                                                                                                                                                                          Entrypoint Preview

                                                                                                                                                                                                                                          Instruction
                                                                                                                                                                                                                                          push ebp
                                                                                                                                                                                                                                          mov ebp, esp
                                                                                                                                                                                                                                          sub esp, 000003F4h
                                                                                                                                                                                                                                          push ebx
                                                                                                                                                                                                                                          push esi
                                                                                                                                                                                                                                          push edi
                                                                                                                                                                                                                                          push 00000020h
                                                                                                                                                                                                                                          pop edi
                                                                                                                                                                                                                                          xor ebx, ebx
                                                                                                                                                                                                                                          push 00008001h
                                                                                                                                                                                                                                          mov dword ptr [ebp-14h], ebx
                                                                                                                                                                                                                                          mov dword ptr [ebp-04h], 0040A2E0h
                                                                                                                                                                                                                                          mov dword ptr [ebp-10h], ebx
                                                                                                                                                                                                                                          call dword ptr [004080CCh]
                                                                                                                                                                                                                                          mov esi, dword ptr [004080D0h]
                                                                                                                                                                                                                                          lea eax, dword ptr [ebp-00000140h]
                                                                                                                                                                                                                                          push eax
                                                                                                                                                                                                                                          mov dword ptr [ebp-0000012Ch], ebx
                                                                                                                                                                                                                                          mov dword ptr [ebp-2Ch], ebx
                                                                                                                                                                                                                                          mov dword ptr [ebp-28h], ebx
                                                                                                                                                                                                                                          mov dword ptr [ebp-00000140h], 0000011Ch
                                                                                                                                                                                                                                          call esi
                                                                                                                                                                                                                                          test eax, eax
                                                                                                                                                                                                                                          jne 00007F3854B7F0BAh
                                                                                                                                                                                                                                          lea eax, dword ptr [ebp-00000140h]
                                                                                                                                                                                                                                          mov dword ptr [ebp-00000140h], 00000114h
                                                                                                                                                                                                                                          push eax
                                                                                                                                                                                                                                          call esi
                                                                                                                                                                                                                                          mov ax, word ptr [ebp-0000012Ch]
                                                                                                                                                                                                                                          mov ecx, dword ptr [ebp-00000112h]
                                                                                                                                                                                                                                          sub ax, 00000053h
                                                                                                                                                                                                                                          add ecx, FFFFFFD0h
                                                                                                                                                                                                                                          neg ax
                                                                                                                                                                                                                                          sbb eax, eax
                                                                                                                                                                                                                                          mov byte ptr [ebp-26h], 00000004h
                                                                                                                                                                                                                                          not eax
                                                                                                                                                                                                                                          and eax, ecx
                                                                                                                                                                                                                                          mov word ptr [ebp-2Ch], ax
                                                                                                                                                                                                                                          cmp dword ptr [ebp-0000013Ch], 0Ah
                                                                                                                                                                                                                                          jnc 00007F3854B7F08Ah
                                                                                                                                                                                                                                          and word ptr [ebp-00000132h], 0000h
                                                                                                                                                                                                                                          mov eax, dword ptr [ebp-00000134h]
                                                                                                                                                                                                                                          movzx ecx, byte ptr [ebp-00000138h]
                                                                                                                                                                                                                                          mov dword ptr [00434FB8h], eax
                                                                                                                                                                                                                                          xor eax, eax
                                                                                                                                                                                                                                          mov ah, byte ptr [ebp-0000013Ch]
                                                                                                                                                                                                                                          movzx eax, ax
                                                                                                                                                                                                                                          or eax, ecx
                                                                                                                                                                                                                                          xor ecx, ecx
                                                                                                                                                                                                                                          mov ch, byte ptr [ebp-2Ch]
                                                                                                                                                                                                                                          movzx ecx, cx
                                                                                                                                                                                                                                          shl eax, 10h
                                                                                                                                                                                                                                          or eax, ecx

                                                                                                                                                                                                                                          Rich Headers

                                                                                                                                                                                                                                          Programming Language:
                                                                                                                                                                                                                                          • [EXP] VC++ 6.0 SP5 build 8804

                                                                                                                                                                                                                                          Data Directories

                                                                                                                                                                                                                                          NameVirtual AddressVirtual Size Is in Section
                                                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_IMPORT0x86100xa0.rdata
                                                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_RESOURCE0x6c0000x4f40.rsrc
                                                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_SECURITY0x2bd000x2968.data
                                                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
                                                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_IAT0x80000x2b0.rdata
                                                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                                                                                                                                          Sections

                                                                                                                                                                                                                                          NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                                                                                                                                          .text0x10000x68970x6a00ce9df19df15aa7bfbc0a8d0af0b841d0False0.6661261792452831data6.458398214928006IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                                          .rdata0x80000x14a60x1600a118375c929d970903c1204233b7583dFalse0.4392755681818182data5.024109281264143IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                                          .data0xa0000x2b0180x60082a10c59a8679bb952fc8316070b8a6cFalse0.521484375data4.15458210408643IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                                          .ndata0x360000x360000x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                                          .rsrc0x6c0000x4f400x50006147c56de0951034d77b52b0075b790fFalse0.1015625data2.760740823683962IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

                                                                                                                                                                                                                                          Resources

                                                                                                                                                                                                                                          NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                                                                                                                                                          RT_ICON0x6c2080x4228Device independent bitmap graphic, 64 x 128 x 32, image size 16384, resolution 2834 x 2834 px/mEnglishUnited States0.036372224846480866
                                                                                                                                                                                                                                          RT_DIALOG0x704300x202dataEnglishUnited States0.4085603112840467
                                                                                                                                                                                                                                          RT_DIALOG0x706380xf8dataEnglishUnited States0.6290322580645161
                                                                                                                                                                                                                                          RT_DIALOG0x707300xa0dataEnglishUnited States0.60625
                                                                                                                                                                                                                                          RT_DIALOG0x707d00xeedataEnglishUnited States0.6302521008403361
                                                                                                                                                                                                                                          RT_GROUP_ICON0x708c00x14dataEnglishUnited States1.1
                                                                                                                                                                                                                                          RT_VERSION0x708d80x240dataEnglishUnited States0.4895833333333333
                                                                                                                                                                                                                                          RT_MANIFEST0x70b180x423XML 1.0 document, ASCII text, with very long lines (1059), with no line terminatorsEnglishUnited States0.5127478753541076

                                                                                                                                                                                                                                          Imports

                                                                                                                                                                                                                                          DLLImport
                                                                                                                                                                                                                                          ADVAPI32.dllRegCreateKeyExW, RegEnumKeyW, RegQueryValueExW, RegSetValueExW, RegCloseKey, RegDeleteValueW, RegDeleteKeyW, AdjustTokenPrivileges, LookupPrivilegeValueW, OpenProcessToken, SetFileSecurityW, RegOpenKeyExW, RegEnumValueW
                                                                                                                                                                                                                                          SHELL32.dllSHGetSpecialFolderLocation, SHFileOperationW, SHBrowseForFolderW, SHGetPathFromIDListW, ShellExecuteExW, SHGetFileInfoW
                                                                                                                                                                                                                                          ole32.dllOleInitialize, OleUninitialize, CoCreateInstance, IIDFromString, CoTaskMemFree
                                                                                                                                                                                                                                          COMCTL32.dllImageList_Create, ImageList_Destroy, ImageList_AddMasked
                                                                                                                                                                                                                                          USER32.dllGetClientRect, EndPaint, DrawTextW, IsWindowEnabled, DispatchMessageW, wsprintfA, CharNextA, CharPrevW, MessageBoxIndirectW, GetDlgItemTextW, SetDlgItemTextW, GetSystemMetrics, FillRect, AppendMenuW, TrackPopupMenu, OpenClipboard, SetClipboardData, CloseClipboard, IsWindowVisible, CallWindowProcW, GetMessagePos, CheckDlgButton, LoadCursorW, SetCursor, GetSysColor, SetWindowPos, GetWindowLongW, PeekMessageW, SetClassLongW, GetSystemMenu, EnableMenuItem, GetWindowRect, ScreenToClient, EndDialog, RegisterClassW, SystemParametersInfoW, CreateWindowExW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, SetForegroundWindow, ShowWindow, wsprintfW, SendMessageTimeoutW, FindWindowExW, IsWindow, GetDlgItem, SetWindowLongW, LoadImageW, GetDC, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, EmptyClipboard, CreatePopupMenu
                                                                                                                                                                                                                                          GDI32.dllSetBkMode, SetBkColor, GetDeviceCaps, CreateFontIndirectW, CreateBrushIndirect, DeleteObject, SetTextColor, SelectObject
                                                                                                                                                                                                                                          KERNEL32.dllGetExitCodeProcess, WaitForSingleObject, GetModuleHandleA, GetProcAddress, GetSystemDirectoryW, lstrcatW, Sleep, lstrcpyA, WriteFile, GetTempFileNameW, CreateFileW, lstrcmpiA, RemoveDirectoryW, CreateProcessW, CreateDirectoryW, GetLastError, CreateThread, GlobalLock, GlobalUnlock, GetDiskFreeSpaceW, WideCharToMultiByte, lstrcpynW, lstrlenW, SetErrorMode, GetVersionExW, GetCommandLineW, GetTempPathW, GetWindowsDirectoryW, SetEnvironmentVariableW, CopyFileW, ExitProcess, GetCurrentProcess, GetModuleFileNameW, GetFileSize, GetTickCount, MulDiv, SetFileAttributesW, GetFileAttributesW, SetCurrentDirectoryW, MoveFileW, GetFullPathNameW, GetShortPathNameW, SearchPathW, CompareFileTime, SetFileTime, CloseHandle, lstrcmpiW, lstrcmpW, ExpandEnvironmentStringsW, GlobalFree, GlobalAlloc, GetModuleHandleW, LoadLibraryExW, MoveFileExW, FreeLibrary, WritePrivateProfileStringW, GetPrivateProfileStringW, lstrlenA, MultiByteToWideChar, ReadFile, SetFilePointer, FindClose, FindNextFileW, FindFirstFileW, DeleteFileW

                                                                                                                                                                                                                                          Possible Origin

                                                                                                                                                                                                                                          Language of compilation systemCountry where language is spokenMap
                                                                                                                                                                                                                                          EnglishUnited States

                                                                                                                                                                                                                                          Network Behavior

                                                                                                                                                                                                                                          ⊘Skipped network analysis since the amount of network traffic is too extensive. Please download the PCAP and check manually.

                                                                                                                                                                                                                                          Statistics

                                                                                                                                                                                                                                          CPU Usage

                                                                                                                                                                                                                                          Click to jump to process

                                                                                                                                                                                                                                          Memory Usage

                                                                                                                                                                                                                                          Click to jump to process

                                                                                                                                                                                                                                          High Level Behavior Distribution

                                                                                                                                                                                                                                          Click to dive into process behavior distribution

                                                                                                                                                                                                                                          Behavior

                                                                                                                                                                                                                                          Click to jump to process

                                                                                                                                                                                                                                          System Behavior

                                                                                                                                                                                                                                          General

                                                                                                                                                                                                                                          Target ID:0
                                                                                                                                                                                                                                          Start time:12:24:48
                                                                                                                                                                                                                                          Start date:06/11/2024
                                                                                                                                                                                                                                          Path:C:\Users\user\Desktop\Setup.exe
                                                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                                                          Commandline:"C:\Users\user\Desktop\Setup.exe"
                                                                                                                                                                                                                                          Imagebase:0x400000
                                                                                                                                                                                                                                          File size:190'056 bytes
                                                                                                                                                                                                                                          MD5 hash:5DF7CCB72D4007E7FAE710495B42DE76
                                                                                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                                          Reputation:low
                                                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                                                          General

                                                                                                                                                                                                                                          Target ID:3
                                                                                                                                                                                                                                          Start time:12:24:57
                                                                                                                                                                                                                                          Start date:06/11/2024
                                                                                                                                                                                                                                          Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                                                                                          Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://pcapp.store/installing.php?guid=4D802742-3099-9C0E-C19B-2A23EA1FC420&winver=19045&version=fa.1092c&nocache=20241106122456.947&_fcid=1730911513052455
                                                                                                                                                                                                                                          Imagebase:0x7ff684c40000
                                                                                                                                                                                                                                          File size:3'242'272 bytes
                                                                                                                                                                                                                                          MD5 hash:5BBFA6CBDF4C254EB368D534F9E23C92
                                                                                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                                          Reputation:high
                                                                                                                                                                                                                                          Has exited:false

                                                                                                                                                                                                                                          General

                                                                                                                                                                                                                                          Target ID:5
                                                                                                                                                                                                                                          Start time:12:24:58
                                                                                                                                                                                                                                          Start date:06/11/2024
                                                                                                                                                                                                                                          Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                                                                                          Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1924 --field-trial-handle=2216,i,9566765671550453842,14323694336698430932,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
                                                                                                                                                                                                                                          Imagebase:0x7ff684c40000
                                                                                                                                                                                                                                          File size:3'242'272 bytes
                                                                                                                                                                                                                                          MD5 hash:5BBFA6CBDF4C254EB368D534F9E23C92
                                                                                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                                          Reputation:high
                                                                                                                                                                                                                                          Has exited:false

                                                                                                                                                                                                                                          General

                                                                                                                                                                                                                                          Target ID:6
                                                                                                                                                                                                                                          Start time:12:25:02
                                                                                                                                                                                                                                          Start date:06/11/2024
                                                                                                                                                                                                                                          Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                                                                                          Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5228 --field-trial-handle=2216,i,9566765671550453842,14323694336698430932,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
                                                                                                                                                                                                                                          Imagebase:0x7ff684c40000
                                                                                                                                                                                                                                          File size:3'242'272 bytes
                                                                                                                                                                                                                                          MD5 hash:5BBFA6CBDF4C254EB368D534F9E23C92
                                                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                                          Reputation:high
                                                                                                                                                                                                                                          Has exited:false

                                                                                                                                                                                                                                          General

                                                                                                                                                                                                                                          Target ID:7
                                                                                                                                                                                                                                          Start time:12:25:02
                                                                                                                                                                                                                                          Start date:06/11/2024
                                                                                                                                                                                                                                          Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                                                                                          Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5276 --field-trial-handle=2216,i,9566765671550453842,14323694336698430932,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
                                                                                                                                                                                                                                          Imagebase:0x7ff684c40000
                                                                                                                                                                                                                                          File size:3'242'272 bytes
                                                                                                                                                                                                                                          MD5 hash:5BBFA6CBDF4C254EB368D534F9E23C92
                                                                                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                                          Reputation:high
                                                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                                                          General

                                                                                                                                                                                                                                          Target ID:9
                                                                                                                                                                                                                                          Start time:12:25:17
                                                                                                                                                                                                                                          Start date:06/11/2024
                                                                                                                                                                                                                                          Path:C:\Users\user\AppData\Local\Temp\nswC086.tmp
                                                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                                                          Commandline:"C:\Users\user\AppData\Local\Temp\nswC086.tmp" /internal 1730911513052455 /force
                                                                                                                                                                                                                                          Imagebase:0x400000
                                                                                                                                                                                                                                          File size:93'386'616 bytes
                                                                                                                                                                                                                                          MD5 hash:84EE733F8014D22DAD2DFEF725489980
                                                                                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                                          Antivirus matches:
                                                                                                                                                                                                                                          • Detection: 46%, ReversingLabs
                                                                                                                                                                                                                                          Reputation:low
                                                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                                                          General

                                                                                                                                                                                                                                          Target ID:11
                                                                                                                                                                                                                                          Start time:12:25:56
                                                                                                                                                                                                                                          Start date:06/11/2024
                                                                                                                                                                                                                                          Path:C:\Users\user\PCAppStore\PcAppStore.exe
                                                                                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                                                                                          Commandline:"C:\Users\user\PCAppStore\PcAppStore.exe" /init default
                                                                                                                                                                                                                                          Imagebase:0x7ff72f9c0000
                                                                                                                                                                                                                                          File size:3'116'888 bytes
                                                                                                                                                                                                                                          MD5 hash:4B88D8ADA8D22622C30D581FC38EAA52
                                                                                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                                          Antivirus matches:
                                                                                                                                                                                                                                          • Detection: 8%, ReversingLabs
                                                                                                                                                                                                                                          Reputation:low
                                                                                                                                                                                                                                          Has exited:false

                                                                                                                                                                                                                                          General

                                                                                                                                                                                                                                          Target ID:12
                                                                                                                                                                                                                                          Start time:12:25:56
                                                                                                                                                                                                                                          Start date:06/11/2024
                                                                                                                                                                                                                                          Path:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                                                                                          Commandline:"C:\Users\user\PCAppStore\Watchdog.exe" /guid=4D802742-3099-9C0E-C19B-2A23EA1FC420 /rid=20241106122556.806529687 /ver=fa.1092c
                                                                                                                                                                                                                                          Imagebase:0x7ff70d300000
                                                                                                                                                                                                                                          File size:276'312 bytes
                                                                                                                                                                                                                                          MD5 hash:11F3801CB9FF046D6075F681971C4EB8
                                                                                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                                          Antivirus matches:
                                                                                                                                                                                                                                          • Detection: 5%, ReversingLabs
                                                                                                                                                                                                                                          Reputation:low
                                                                                                                                                                                                                                          Has exited:false

                                                                                                                                                                                                                                          General

                                                                                                                                                                                                                                          Target ID:13
                                                                                                                                                                                                                                          Start time:12:25:56
                                                                                                                                                                                                                                          Start date:06/11/2024
                                                                                                                                                                                                                                          Path:C:\Windows\explorer.exe
                                                                                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                                                                                          Commandline:C:\Windows\Explorer.EXE
                                                                                                                                                                                                                                          Imagebase:0x7ff609140000
                                                                                                                                                                                                                                          File size:5'141'208 bytes
                                                                                                                                                                                                                                          MD5 hash:662F4F92FDE3557E86D110526BB578D5
                                                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                                          Reputation:high
                                                                                                                                                                                                                                          Has exited:false

                                                                                                                                                                                                                                          General

                                                                                                                                                                                                                                          Target ID:15
                                                                                                                                                                                                                                          Start time:12:26:01
                                                                                                                                                                                                                                          Start date:06/11/2024
                                                                                                                                                                                                                                          Path:C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exe
                                                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                                                          Commandline:"C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exe"
                                                                                                                                                                                                                                          Imagebase:0x5e0000
                                                                                                                                                                                                                                          File size:140'800 bytes
                                                                                                                                                                                                                                          MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                                          Reputation:high
                                                                                                                                                                                                                                          Has exited:false

                                                                                                                                                                                                                                          General

                                                                                                                                                                                                                                          Target ID:17
                                                                                                                                                                                                                                          Start time:12:26:02
                                                                                                                                                                                                                                          Start date:06/11/2024
                                                                                                                                                                                                                                          Path:C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exe
                                                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                                                          Commandline:"C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exe"
                                                                                                                                                                                                                                          Imagebase:0x5e0000
                                                                                                                                                                                                                                          File size:140'800 bytes
                                                                                                                                                                                                                                          MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                                          Reputation:high
                                                                                                                                                                                                                                          Has exited:false

                                                                                                                                                                                                                                          General

                                                                                                                                                                                                                                          Target ID:18
                                                                                                                                                                                                                                          Start time:12:26:02
                                                                                                                                                                                                                                          Start date:06/11/2024
                                                                                                                                                                                                                                          Path:C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exe
                                                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                                                          Commandline:"C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exe"
                                                                                                                                                                                                                                          Imagebase:0x5e0000
                                                                                                                                                                                                                                          File size:140'800 bytes
                                                                                                                                                                                                                                          MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                                          Has exited:false

                                                                                                                                                                                                                                          General

                                                                                                                                                                                                                                          Target ID:19
                                                                                                                                                                                                                                          Start time:12:26:02
                                                                                                                                                                                                                                          Start date:06/11/2024
                                                                                                                                                                                                                                          Path:C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exe
                                                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                                                          Commandline:"C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exe"
                                                                                                                                                                                                                                          Imagebase:0x5e0000
                                                                                                                                                                                                                                          File size:140'800 bytes
                                                                                                                                                                                                                                          MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                                          Has exited:false

                                                                                                                                                                                                                                          General

                                                                                                                                                                                                                                          Target ID:20
                                                                                                                                                                                                                                          Start time:12:26:03
                                                                                                                                                                                                                                          Start date:06/11/2024
                                                                                                                                                                                                                                          Path:C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exe
                                                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                                                          Commandline:"C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exe"
                                                                                                                                                                                                                                          Imagebase:0x5e0000
                                                                                                                                                                                                                                          File size:140'800 bytes
                                                                                                                                                                                                                                          MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                                          Has exited:false

                                                                                                                                                                                                                                          General

                                                                                                                                                                                                                                          Target ID:21
                                                                                                                                                                                                                                          Start time:12:26:04
                                                                                                                                                                                                                                          Start date:06/11/2024
                                                                                                                                                                                                                                          Path:C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exe
                                                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                                                          Commandline:"C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exe"
                                                                                                                                                                                                                                          Imagebase:0x5e0000
                                                                                                                                                                                                                                          File size:140'800 bytes
                                                                                                                                                                                                                                          MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                                          Has exited:false

                                                                                                                                                                                                                                          General

                                                                                                                                                                                                                                          Target ID:22
                                                                                                                                                                                                                                          Start time:12:26:04
                                                                                                                                                                                                                                          Start date:06/11/2024
                                                                                                                                                                                                                                          Path:C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exe
                                                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                                                          Commandline:"C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exe"
                                                                                                                                                                                                                                          Imagebase:0x5e0000
                                                                                                                                                                                                                                          File size:140'800 bytes
                                                                                                                                                                                                                                          MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                                          Has exited:false

                                                                                                                                                                                                                                          General

                                                                                                                                                                                                                                          Target ID:23
                                                                                                                                                                                                                                          Start time:12:26:04
                                                                                                                                                                                                                                          Start date:06/11/2024
                                                                                                                                                                                                                                          Path:C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exe
                                                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                                                          Commandline:"C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exe"
                                                                                                                                                                                                                                          Imagebase:0x5e0000
                                                                                                                                                                                                                                          File size:140'800 bytes
                                                                                                                                                                                                                                          MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                                          Has exited:false

                                                                                                                                                                                                                                          General

                                                                                                                                                                                                                                          Target ID:24
                                                                                                                                                                                                                                          Start time:12:26:05
                                                                                                                                                                                                                                          Start date:06/11/2024
                                                                                                                                                                                                                                          Path:C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exe
                                                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                                                          Commandline:"C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exe"
                                                                                                                                                                                                                                          Imagebase:0x5e0000
                                                                                                                                                                                                                                          File size:140'800 bytes
                                                                                                                                                                                                                                          MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                                          Has exited:false

                                                                                                                                                                                                                                          General

                                                                                                                                                                                                                                          Target ID:25
                                                                                                                                                                                                                                          Start time:12:26:06
                                                                                                                                                                                                                                          Start date:06/11/2024
                                                                                                                                                                                                                                          Path:C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exe
                                                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                                                          Commandline:"C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exe"
                                                                                                                                                                                                                                          Imagebase:0x5e0000
                                                                                                                                                                                                                                          File size:140'800 bytes
                                                                                                                                                                                                                                          MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                                          Has exited:false

                                                                                                                                                                                                                                          General

                                                                                                                                                                                                                                          Target ID:26
                                                                                                                                                                                                                                          Start time:12:26:06
                                                                                                                                                                                                                                          Start date:06/11/2024
                                                                                                                                                                                                                                          Path:C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exe
                                                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                                                          Commandline:"C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exe"
                                                                                                                                                                                                                                          Imagebase:0x5e0000
                                                                                                                                                                                                                                          File size:140'800 bytes
                                                                                                                                                                                                                                          MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                                          Has exited:false

                                                                                                                                                                                                                                          General

                                                                                                                                                                                                                                          Target ID:27
                                                                                                                                                                                                                                          Start time:12:26:06
                                                                                                                                                                                                                                          Start date:06/11/2024
                                                                                                                                                                                                                                          Path:C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exe
                                                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                                                          Commandline:"C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exe"
                                                                                                                                                                                                                                          Imagebase:0x5e0000
                                                                                                                                                                                                                                          File size:140'800 bytes
                                                                                                                                                                                                                                          MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                                          Has exited:false

                                                                                                                                                                                                                                          General

                                                                                                                                                                                                                                          Target ID:28
                                                                                                                                                                                                                                          Start time:12:26:06
                                                                                                                                                                                                                                          Start date:06/11/2024
                                                                                                                                                                                                                                          Path:C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exe
                                                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                                                          Commandline:"C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exe"
                                                                                                                                                                                                                                          Imagebase:0x5e0000
                                                                                                                                                                                                                                          File size:140'800 bytes
                                                                                                                                                                                                                                          MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                                          Has exited:false

                                                                                                                                                                                                                                          General

                                                                                                                                                                                                                                          Target ID:29
                                                                                                                                                                                                                                          Start time:12:26:06
                                                                                                                                                                                                                                          Start date:06/11/2024
                                                                                                                                                                                                                                          Path:C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exe
                                                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                                                          Commandline:"C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exe"
                                                                                                                                                                                                                                          Imagebase:0x5e0000
                                                                                                                                                                                                                                          File size:140'800 bytes
                                                                                                                                                                                                                                          MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                                          Has exited:false

                                                                                                                                                                                                                                          General

                                                                                                                                                                                                                                          Target ID:30
                                                                                                                                                                                                                                          Start time:12:26:07
                                                                                                                                                                                                                                          Start date:06/11/2024
                                                                                                                                                                                                                                          Path:C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exe
                                                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                                                          Commandline:"C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exe"
                                                                                                                                                                                                                                          Imagebase:0x5e0000
                                                                                                                                                                                                                                          File size:140'800 bytes
                                                                                                                                                                                                                                          MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                                          Has exited:false

                                                                                                                                                                                                                                          General

                                                                                                                                                                                                                                          Target ID:31
                                                                                                                                                                                                                                          Start time:12:26:07
                                                                                                                                                                                                                                          Start date:06/11/2024
                                                                                                                                                                                                                                          Path:C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exe
                                                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                                                          Commandline:"C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exe"
                                                                                                                                                                                                                                          Imagebase:0x5e0000
                                                                                                                                                                                                                                          File size:140'800 bytes
                                                                                                                                                                                                                                          MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                                          Has exited:false

                                                                                                                                                                                                                                          General

                                                                                                                                                                                                                                          Target ID:32
                                                                                                                                                                                                                                          Start time:12:26:07
                                                                                                                                                                                                                                          Start date:06/11/2024
                                                                                                                                                                                                                                          Path:C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exe
                                                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                                                          Commandline:"C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exe"
                                                                                                                                                                                                                                          Imagebase:0x5e0000
                                                                                                                                                                                                                                          File size:140'800 bytes
                                                                                                                                                                                                                                          MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                                          Has exited:false

                                                                                                                                                                                                                                          General

                                                                                                                                                                                                                                          Target ID:33
                                                                                                                                                                                                                                          Start time:12:26:08
                                                                                                                                                                                                                                          Start date:06/11/2024
                                                                                                                                                                                                                                          Path:C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exe
                                                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                                                          Commandline:"C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exe"
                                                                                                                                                                                                                                          Imagebase:0x5e0000
                                                                                                                                                                                                                                          File size:140'800 bytes
                                                                                                                                                                                                                                          MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                                          Has exited:false

                                                                                                                                                                                                                                          General

                                                                                                                                                                                                                                          Target ID:34
                                                                                                                                                                                                                                          Start time:12:26:08
                                                                                                                                                                                                                                          Start date:06/11/2024
                                                                                                                                                                                                                                          Path:C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exe
                                                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                                                          Commandline:"C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exe"
                                                                                                                                                                                                                                          Imagebase:0x5e0000
                                                                                                                                                                                                                                          File size:140'800 bytes
                                                                                                                                                                                                                                          MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                                          Has exited:false

                                                                                                                                                                                                                                          General

                                                                                                                                                                                                                                          Target ID:35
                                                                                                                                                                                                                                          Start time:12:26:08
                                                                                                                                                                                                                                          Start date:06/11/2024
                                                                                                                                                                                                                                          Path:C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exe
                                                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                                                          Commandline:"C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exe"
                                                                                                                                                                                                                                          Imagebase:0x5e0000
                                                                                                                                                                                                                                          File size:140'800 bytes
                                                                                                                                                                                                                                          MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                                          Has exited:false

                                                                                                                                                                                                                                          General

                                                                                                                                                                                                                                          Target ID:36
                                                                                                                                                                                                                                          Start time:12:26:09
                                                                                                                                                                                                                                          Start date:06/11/2024
                                                                                                                                                                                                                                          Path:C:\Users\user\PCAppStore\PcAppStore.exe
                                                                                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                                                                                          Commandline:"C:\Users\user\PCAppStore\PCAppStore.exe" /init default
                                                                                                                                                                                                                                          Imagebase:0x7ff72f9c0000
                                                                                                                                                                                                                                          File size:3'116'888 bytes
                                                                                                                                                                                                                                          MD5 hash:4B88D8ADA8D22622C30D581FC38EAA52
                                                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                                                          General

                                                                                                                                                                                                                                          Target ID:37
                                                                                                                                                                                                                                          Start time:12:26:09
                                                                                                                                                                                                                                          Start date:06/11/2024
                                                                                                                                                                                                                                          Path:C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exe
                                                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                                                          Commandline:"C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exe"
                                                                                                                                                                                                                                          Imagebase:0x5e0000
                                                                                                                                                                                                                                          File size:140'800 bytes
                                                                                                                                                                                                                                          MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                                          Has exited:false

                                                                                                                                                                                                                                          General

                                                                                                                                                                                                                                          Target ID:38
                                                                                                                                                                                                                                          Start time:12:26:09
                                                                                                                                                                                                                                          Start date:06/11/2024
                                                                                                                                                                                                                                          Path:C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exe
                                                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                                                          Commandline:"C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exe"
                                                                                                                                                                                                                                          Imagebase:0x5e0000
                                                                                                                                                                                                                                          File size:140'800 bytes
                                                                                                                                                                                                                                          MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                                          Has exited:false

                                                                                                                                                                                                                                          General

                                                                                                                                                                                                                                          Target ID:39
                                                                                                                                                                                                                                          Start time:12:26:09
                                                                                                                                                                                                                                          Start date:06/11/2024
                                                                                                                                                                                                                                          Path:C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exe
                                                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                                                          Commandline:"C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exe"
                                                                                                                                                                                                                                          Imagebase:0x5e0000
                                                                                                                                                                                                                                          File size:140'800 bytes
                                                                                                                                                                                                                                          MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                                          Has exited:false

                                                                                                                                                                                                                                          General

                                                                                                                                                                                                                                          Target ID:40
                                                                                                                                                                                                                                          Start time:12:26:10
                                                                                                                                                                                                                                          Start date:06/11/2024
                                                                                                                                                                                                                                          Path:C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exe
                                                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                                                          Commandline:"C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exe"
                                                                                                                                                                                                                                          Imagebase:0x5e0000
                                                                                                                                                                                                                                          File size:140'800 bytes
                                                                                                                                                                                                                                          MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                                          Has exited:false

                                                                                                                                                                                                                                          General

                                                                                                                                                                                                                                          Target ID:41
                                                                                                                                                                                                                                          Start time:12:26:10
                                                                                                                                                                                                                                          Start date:06/11/2024
                                                                                                                                                                                                                                          Path:C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exe
                                                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                                                          Commandline:"C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exe"
                                                                                                                                                                                                                                          Imagebase:0x5e0000
                                                                                                                                                                                                                                          File size:140'800 bytes
                                                                                                                                                                                                                                          MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                                          Has exited:false

                                                                                                                                                                                                                                          General

                                                                                                                                                                                                                                          Target ID:42
                                                                                                                                                                                                                                          Start time:12:26:10
                                                                                                                                                                                                                                          Start date:06/11/2024
                                                                                                                                                                                                                                          Path:C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exe
                                                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                                                          Commandline:"C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exe"
                                                                                                                                                                                                                                          Imagebase:0x5e0000
                                                                                                                                                                                                                                          File size:140'800 bytes
                                                                                                                                                                                                                                          MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                                          Has exited:false

                                                                                                                                                                                                                                          General

                                                                                                                                                                                                                                          Target ID:43
                                                                                                                                                                                                                                          Start time:12:26:10
                                                                                                                                                                                                                                          Start date:06/11/2024
                                                                                                                                                                                                                                          Path:C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exe
                                                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                                                          Commandline:"C:\Program Files (x86)\KZinxHIbEpbAbZDaxDzfzThISaozUbzwYyHBXHmNceJLkzzkkYavHdwMzDHYcuDet\MLLHdqUcwgfrtUaposkqsOihMsq.exe"
                                                                                                                                                                                                                                          Imagebase:0x5e0000
                                                                                                                                                                                                                                          File size:140'800 bytes
                                                                                                                                                                                                                                          MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                                          Has exited:false

                                                                                                                                                                                                                                          Disassembly

                                                                                                                                                                                                                                          Reset < >

                                                                                                                                                                                                                                            Execution Graph

                                                                                                                                                                                                                                            Execution Coverage:28.9%
                                                                                                                                                                                                                                            Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                                                                            Signature Coverage:16.6%
                                                                                                                                                                                                                                            Total number of Nodes:1349
                                                                                                                                                                                                                                            Total number of Limit Nodes:40
                                                                                                                                                                                                                                            execution_graph 2924 4015c1 2943 402da6 2924->2943 2928 401631 2930 401663 2928->2930 2931 401636 2928->2931 2933 401423 24 API calls 2930->2933 2970 401423 2931->2970 2940 40165b 2933->2940 2938 40164a SetCurrentDirectoryW 2938->2940 2939 401617 GetFileAttributesW 2941 4015d1 2939->2941 2941->2928 2941->2939 2955 405e39 2941->2955 2959 405b08 2941->2959 2962 405a6e CreateDirectoryW 2941->2962 2967 405aeb CreateDirectoryW 2941->2967 2944 402db2 2943->2944 2974 40657a 2944->2974 2947 4015c8 2949 405eb7 CharNextW CharNextW 2947->2949 2950 405ed4 2949->2950 2954 405ee6 2949->2954 2951 405ee1 CharNextW 2950->2951 2950->2954 2952 405f0a 2951->2952 2952->2941 2953 405e39 CharNextW 2953->2954 2954->2952 2954->2953 2956 405e3f 2955->2956 2957 405e55 2956->2957 2958 405e46 CharNextW 2956->2958 2957->2941 2958->2956 3012 40690a GetModuleHandleA 2959->3012 2963 405abb 2962->2963 2964 405abf GetLastError 2962->2964 2963->2941 2964->2963 2965 405ace SetFileSecurityW 2964->2965 2965->2963 2966 405ae4 GetLastError 2965->2966 2966->2963 2968 405afb 2967->2968 2969 405aff GetLastError 2967->2969 2968->2941 2969->2968 3021 40559f 2970->3021 2973 40653d lstrcpynW 2973->2938 2978 406587 2974->2978 2975 4067aa 2976 402dd3 2975->2976 3007 40653d lstrcpynW 2975->3007 2976->2947 2991 4067c4 2976->2991 2978->2975 2979 406778 lstrlenW 2978->2979 2982 40657a 10 API calls 2978->2982 2983 40668f GetSystemDirectoryW 2978->2983 2985 4066a2 GetWindowsDirectoryW 2978->2985 2986 406719 lstrcatW 2978->2986 2987 40657a 10 API calls 2978->2987 2988 4067c4 5 API calls 2978->2988 2989 4066d1 SHGetSpecialFolderLocation 2978->2989 3000 40640b 2978->3000 3005 406484 wsprintfW 2978->3005 3006 40653d lstrcpynW 2978->3006 2979->2978 2982->2979 2983->2978 2985->2978 2986->2978 2987->2978 2988->2978 2989->2978 2990 4066e9 SHGetPathFromIDListW CoTaskMemFree 2989->2990 2990->2978 2997 4067d1 2991->2997 2992 406847 2993 40684c CharPrevW 2992->2993 2995 40686d 2992->2995 2993->2992 2994 40683a CharNextW 2994->2992 2994->2997 2995->2947 2996 405e39 CharNextW 2996->2997 2997->2992 2997->2994 2997->2996 2998 406826 CharNextW 2997->2998 2999 406835 CharNextW 2997->2999 2998->2997 2999->2994 3008 4063aa 3000->3008 3003 40646f 3003->2978 3004 40643f RegQueryValueExW RegCloseKey 3004->3003 3005->2978 3006->2978 3007->2976 3009 4063b9 3008->3009 3010 4063c2 RegOpenKeyExW 3009->3010 3011 4063bd 3009->3011 3010->3011 3011->3003 3011->3004 3013 406930 GetProcAddress 3012->3013 3014 406926 3012->3014 3016 405b0f 3013->3016 3018 40689a GetSystemDirectoryW 3014->3018 3016->2941 3017 40692c 3017->3013 3017->3016 3019 4068bc wsprintfW LoadLibraryExW 3018->3019 3019->3017 3022 4055ba 3021->3022 3023 401431 3021->3023 3024 4055d6 lstrlenW 3022->3024 3025 40657a 17 API calls 3022->3025 3023->2973 3026 4055e4 lstrlenW 3024->3026 3027 4055ff 3024->3027 3025->3024 3026->3023 3028 4055f6 lstrcatW 3026->3028 3029 405612 3027->3029 3030 405605 SetWindowTextW 3027->3030 3028->3027 3029->3023 3031 405618 SendMessageW SendMessageW SendMessageW 3029->3031 3030->3029 3031->3023 3032 401941 3033 401943 3032->3033 3034 402da6 17 API calls 3033->3034 3035 401948 3034->3035 3038 405c49 3035->3038 3074 405f14 3038->3074 3041 405c71 DeleteFileW 3072 401951 3041->3072 3042 405c88 3043 405da8 3042->3043 3088 40653d lstrcpynW 3042->3088 3043->3072 3106 406873 FindFirstFileW 3043->3106 3045 405cae 3046 405cc1 3045->3046 3047 405cb4 lstrcatW 3045->3047 3089 405e58 lstrlenW 3046->3089 3049 405cc7 3047->3049 3051 405cd7 lstrcatW 3049->3051 3053 405ce2 lstrlenW FindFirstFileW 3049->3053 3051->3053 3053->3043 3065 405d04 3053->3065 3056 405d8b FindNextFileW 3060 405da1 FindClose 3056->3060 3056->3065 3057 405c01 5 API calls 3059 405de3 3057->3059 3061 405de7 3059->3061 3062 405dfd 3059->3062 3060->3043 3066 40559f 24 API calls 3061->3066 3061->3072 3064 40559f 24 API calls 3062->3064 3064->3072 3065->3056 3067 405c49 60 API calls 3065->3067 3069 40559f 24 API calls 3065->3069 3071 40559f 24 API calls 3065->3071 3093 40653d lstrcpynW 3065->3093 3094 405c01 3065->3094 3102 4062fd MoveFileExW 3065->3102 3068 405df4 3066->3068 3067->3065 3070 4062fd 36 API calls 3068->3070 3069->3056 3070->3072 3071->3065 3112 40653d lstrcpynW 3074->3112 3076 405f25 3077 405eb7 4 API calls 3076->3077 3078 405f2b 3077->3078 3079 405c69 3078->3079 3080 4067c4 5 API calls 3078->3080 3079->3041 3079->3042 3086 405f3b 3080->3086 3081 405f6c lstrlenW 3082 405f77 3081->3082 3081->3086 3084 405e0c 3 API calls 3082->3084 3083 406873 2 API calls 3083->3086 3085 405f7c GetFileAttributesW 3084->3085 3085->3079 3086->3079 3086->3081 3086->3083 3087 405e58 2 API calls 3086->3087 3087->3081 3088->3045 3090 405e66 3089->3090 3091 405e78 3090->3091 3092 405e6c CharPrevW 3090->3092 3091->3049 3092->3090 3092->3091 3093->3065 3113 406008 GetFileAttributesW 3094->3113 3097 405c2e 3097->3065 3098 405c24 DeleteFileW 3100 405c2a 3098->3100 3099 405c1c RemoveDirectoryW 3099->3100 3100->3097 3101 405c3a SetFileAttributesW 3100->3101 3101->3097 3103 406311 3102->3103 3105 40631e 3102->3105 3116 406183 3103->3116 3105->3065 3107 405dcd 3106->3107 3108 406889 FindClose 3106->3108 3107->3072 3109 405e0c lstrlenW CharPrevW 3107->3109 3108->3107 3110 405dd7 3109->3110 3111 405e28 lstrcatW 3109->3111 3110->3057 3111->3110 3112->3076 3114 405c0d 3113->3114 3115 40601a SetFileAttributesW 3113->3115 3114->3097 3114->3098 3114->3099 3115->3114 3117 4061b3 3116->3117 3118 4061d9 GetShortPathNameW 3116->3118 3143 40602d GetFileAttributesW CreateFileW 3117->3143 3120 4062f8 3118->3120 3121 4061ee 3118->3121 3120->3105 3121->3120 3123 4061f6 wsprintfA 3121->3123 3122 4061bd CloseHandle GetShortPathNameW 3122->3120 3124 4061d1 3122->3124 3125 40657a 17 API calls 3123->3125 3124->3118 3124->3120 3126 40621e 3125->3126 3144 40602d GetFileAttributesW CreateFileW 3126->3144 3128 40622b 3128->3120 3129 40623a GetFileSize GlobalAlloc 3128->3129 3130 4062f1 CloseHandle 3129->3130 3131 40625c 3129->3131 3130->3120 3145 4060b0 ReadFile 3131->3145 3136 40627b lstrcpyA 3139 40629d 3136->3139 3137 40628f 3138 405f92 4 API calls 3137->3138 3138->3139 3140 4062d4 SetFilePointer 3139->3140 3152 4060df WriteFile 3140->3152 3143->3122 3144->3128 3146 4060ce 3145->3146 3146->3130 3147 405f92 lstrlenA 3146->3147 3148 405fd3 lstrlenA 3147->3148 3149 405fdb 3148->3149 3150 405fac lstrcmpiA 3148->3150 3149->3136 3149->3137 3150->3149 3151 405fca CharNextA 3150->3151 3151->3148 3153 4060fd GlobalFree 3152->3153 3153->3130 3168 401c43 3169 402d84 17 API calls 3168->3169 3170 401c4a 3169->3170 3171 402d84 17 API calls 3170->3171 3172 401c57 3171->3172 3173 401c6c 3172->3173 3174 402da6 17 API calls 3172->3174 3175 401c7c 3173->3175 3176 402da6 17 API calls 3173->3176 3174->3173 3177 401cd3 3175->3177 3178 401c87 3175->3178 3176->3175 3180 402da6 17 API calls 3177->3180 3179 402d84 17 API calls 3178->3179 3182 401c8c 3179->3182 3181 401cd8 3180->3181 3183 402da6 17 API calls 3181->3183 3184 402d84 17 API calls 3182->3184 3185 401ce1 FindWindowExW 3183->3185 3186 401c98 3184->3186 3189 401d03 3185->3189 3187 401cc3 SendMessageW 3186->3187 3188 401ca5 SendMessageTimeoutW 3186->3188 3187->3189 3188->3189 3834 404943 3835 404953 3834->3835 3836 404979 3834->3836 3837 404499 18 API calls 3835->3837 3838 404500 8 API calls 3836->3838 3839 404960 SetDlgItemTextW 3837->3839 3840 404985 3838->3840 3839->3836 3841 4028c4 3842 4028ca 3841->3842 3843 4028d2 FindClose 3842->3843 3844 402c2a 3842->3844 3843->3844 3848 4016cc 3849 402da6 17 API calls 3848->3849 3850 4016d2 GetFullPathNameW 3849->3850 3851 4016ec 3850->3851 3857 40170e 3850->3857 3854 406873 2 API calls 3851->3854 3851->3857 3852 401723 GetShortPathNameW 3853 402c2a 3852->3853 3855 4016fe 3854->3855 3855->3857 3858 40653d lstrcpynW 3855->3858 3857->3852 3857->3853 3858->3857 3859 401e4e GetDC 3860 402d84 17 API calls 3859->3860 3861 401e60 GetDeviceCaps MulDiv ReleaseDC 3860->3861 3862 402d84 17 API calls 3861->3862 3863 401e91 3862->3863 3864 40657a 17 API calls 3863->3864 3865 401ece CreateFontIndirectW 3864->3865 3866 402638 3865->3866 3867 4045cf lstrcpynW lstrlenW 3868 402950 3869 402da6 17 API calls 3868->3869 3871 40295c 3869->3871 3870 402972 3873 406008 2 API calls 3870->3873 3871->3870 3872 402da6 17 API calls 3871->3872 3872->3870 3874 402978 3873->3874 3896 40602d GetFileAttributesW CreateFileW 3874->3896 3876 402985 3877 402a3b 3876->3877 3878 4029a0 GlobalAlloc 3876->3878 3879 402a23 3876->3879 3880 402a42 DeleteFileW 3877->3880 3881 402a55 3877->3881 3878->3879 3882 4029b9 3878->3882 3883 4032b4 31 API calls 3879->3883 3880->3881 3897 4034e5 SetFilePointer 3882->3897 3885 402a30 CloseHandle 3883->3885 3885->3877 3886 4029bf 3887 4034cf ReadFile 3886->3887 3888 4029c8 GlobalAlloc 3887->3888 3889 4029d8 3888->3889 3890 402a0c 3888->3890 3891 4032b4 31 API calls 3889->3891 3892 4060df WriteFile 3890->3892 3895 4029e5 3891->3895 3893 402a18 GlobalFree 3892->3893 3893->3879 3894 402a03 GlobalFree 3894->3890 3895->3894 3896->3876 3897->3886 3898 401956 3899 402da6 17 API calls 3898->3899 3900 40195d lstrlenW 3899->3900 3901 402638 3900->3901 3902 4014d7 3903 402d84 17 API calls 3902->3903 3904 4014dd Sleep 3903->3904 3906 402c2a 3904->3906 3617 4020d8 3618 4020ea 3617->3618 3628 40219c 3617->3628 3619 402da6 17 API calls 3618->3619 3621 4020f1 3619->3621 3620 401423 24 API calls 3626 4022f6 3620->3626 3622 402da6 17 API calls 3621->3622 3623 4020fa 3622->3623 3624 402110 LoadLibraryExW 3623->3624 3625 402102 GetModuleHandleW 3623->3625 3627 402121 3624->3627 3624->3628 3625->3624 3625->3627 3637 406979 3627->3637 3628->3620 3631 402132 3634 401423 24 API calls 3631->3634 3635 402142 3631->3635 3632 40216b 3633 40559f 24 API calls 3632->3633 3633->3635 3634->3635 3635->3626 3636 40218e FreeLibrary 3635->3636 3636->3626 3642 40655f WideCharToMultiByte 3637->3642 3639 406996 3640 40699d GetProcAddress 3639->3640 3641 40212c 3639->3641 3640->3641 3641->3631 3641->3632 3642->3639 3907 404658 3908 404670 3907->3908 3914 40478a 3907->3914 3915 404499 18 API calls 3908->3915 3909 4047f4 3910 4048be 3909->3910 3911 4047fe GetDlgItem 3909->3911 3916 404500 8 API calls 3910->3916 3912 404818 3911->3912 3913 40487f 3911->3913 3912->3913 3920 40483e SendMessageW LoadCursorW SetCursor 3912->3920 3913->3910 3921 404891 3913->3921 3914->3909 3914->3910 3917 4047c5 GetDlgItem SendMessageW 3914->3917 3918 4046d7 3915->3918 3919 4048b9 3916->3919 3940 4044bb KiUserCallbackDispatcher 3917->3940 3923 404499 18 API calls 3918->3923 3944 404907 3920->3944 3926 4048a7 3921->3926 3927 404897 SendMessageW 3921->3927 3924 4046e4 CheckDlgButton 3923->3924 3938 4044bb KiUserCallbackDispatcher 3924->3938 3926->3919 3931 4048ad SendMessageW 3926->3931 3927->3926 3928 4047ef 3941 4048e3 3928->3941 3931->3919 3933 404702 GetDlgItem 3939 4044ce SendMessageW 3933->3939 3935 404718 SendMessageW 3936 404735 GetSysColor 3935->3936 3937 40473e SendMessageW SendMessageW lstrlenW SendMessageW SendMessageW 3935->3937 3936->3937 3937->3919 3938->3933 3939->3935 3940->3928 3942 4048f1 3941->3942 3943 4048f6 SendMessageW 3941->3943 3942->3943 3943->3909 3947 405b63 ShellExecuteExW 3944->3947 3946 40486d LoadCursorW SetCursor 3946->3913 3947->3946 3948 402b59 3949 402b60 3948->3949 3950 402bab 3948->3950 3953 402d84 17 API calls 3949->3953 3956 402ba9 3949->3956 3951 40690a 5 API calls 3950->3951 3952 402bb2 3951->3952 3954 402da6 17 API calls 3952->3954 3955 402b6e 3953->3955 3957 402bbb 3954->3957 3958 402d84 17 API calls 3955->3958 3957->3956 3959 402bbf IIDFromString 3957->3959 3961 402b7a 3958->3961 3959->3956 3960 402bce 3959->3960 3960->3956 3966 40653d lstrcpynW 3960->3966 3965 406484 wsprintfW 3961->3965 3964 402beb CoTaskMemFree 3964->3956 3965->3956 3966->3964 3760 40175c 3761 402da6 17 API calls 3760->3761 3762 401763 3761->3762 3763 40605c 2 API calls 3762->3763 3764 40176a 3763->3764 3765 40605c 2 API calls 3764->3765 3765->3764 3967 401d5d 3968 402d84 17 API calls 3967->3968 3969 401d6e SetWindowLongW 3968->3969 3970 402c2a 3969->3970 3766 4056de 3767 405888 3766->3767 3768 4056ff GetDlgItem GetDlgItem GetDlgItem 3766->3768 3770 405891 GetDlgItem CreateThread CloseHandle 3767->3770 3771 4058b9 3767->3771 3811 4044ce SendMessageW 3768->3811 3770->3771 3814 405672 5 API calls 3770->3814 3773 4058e4 3771->3773 3775 4058d0 ShowWindow ShowWindow 3771->3775 3776 405909 3771->3776 3772 40576f 3780 405776 GetClientRect GetSystemMetrics SendMessageW SendMessageW 3772->3780 3774 405944 3773->3774 3777 4058f8 3773->3777 3778 40591e ShowWindow 3773->3778 3774->3776 3787 405952 SendMessageW 3774->3787 3813 4044ce SendMessageW 3775->3813 3779 404500 8 API calls 3776->3779 3782 404472 SendMessageW 3777->3782 3783 405930 3778->3783 3784 40593e 3778->3784 3792 405917 3779->3792 3785 4057e4 3780->3785 3786 4057c8 SendMessageW SendMessageW 3780->3786 3782->3776 3788 40559f 24 API calls 3783->3788 3789 404472 SendMessageW 3784->3789 3790 4057f7 3785->3790 3791 4057e9 SendMessageW 3785->3791 3786->3785 3787->3792 3793 40596b CreatePopupMenu 3787->3793 3788->3784 3789->3774 3795 404499 18 API calls 3790->3795 3791->3790 3794 40657a 17 API calls 3793->3794 3796 40597b AppendMenuW 3794->3796 3797 405807 3795->3797 3798 405998 GetWindowRect 3796->3798 3799 4059ab TrackPopupMenu 3796->3799 3800 405810 ShowWindow 3797->3800 3801 405844 GetDlgItem SendMessageW 3797->3801 3798->3799 3799->3792 3802 4059c6 3799->3802 3803 405833 3800->3803 3804 405826 ShowWindow 3800->3804 3801->3792 3805 40586b SendMessageW SendMessageW 3801->3805 3806 4059e2 SendMessageW 3802->3806 3812 4044ce SendMessageW 3803->3812 3804->3803 3805->3792 3806->3806 3807 4059ff OpenClipboard EmptyClipboard GlobalAlloc GlobalLock 3806->3807 3809 405a24 SendMessageW 3807->3809 3809->3809 3810 405a4d GlobalUnlock SetClipboardData CloseClipboard 3809->3810 3810->3792 3811->3772 3812->3801 3813->3773 3815 401ede 3816 402d84 17 API calls 3815->3816 3817 401ee4 3816->3817 3818 402d84 17 API calls 3817->3818 3819 401ef0 3818->3819 3820 401f07 EnableWindow 3819->3820 3821 401efc ShowWindow 3819->3821 3822 402c2a 3820->3822 3821->3822 3971 4028de 3972 4028e6 3971->3972 3973 4028ea FindNextFileW 3972->3973 3976 4028fc 3972->3976 3974 402943 3973->3974 3973->3976 3977 40653d lstrcpynW 3974->3977 3977->3976 3978 404ce0 3979 404cf0 3978->3979 3980 404d0c 3978->3980 3989 405b81 GetDlgItemTextW 3979->3989 3981 404d12 SHGetPathFromIDListW 3980->3981 3982 404d3f 3980->3982 3984 404d29 SendMessageW 3981->3984 3985 404d22 3981->3985 3984->3982 3987 40140b 2 API calls 3985->3987 3986 404cfd SendMessageW 3986->3980 3987->3984 3989->3986 3190 405b63 ShellExecuteExW 3990 401563 3991 402ba4 3990->3991 3994 406484 wsprintfW 3991->3994 3993 402ba9 3994->3993 3995 401968 3996 402d84 17 API calls 3995->3996 3997 40196f 3996->3997 3998 402d84 17 API calls 3997->3998 3999 40197c 3998->3999 4000 402da6 17 API calls 3999->4000 4001 401993 lstrlenW 4000->4001 4002 4019a4 4001->4002 4006 4019e5 4002->4006 4007 40653d lstrcpynW 4002->4007 4004 4019d5 4005 4019da lstrlenW 4004->4005 4004->4006 4005->4006 4007->4004 4008 40166a 4009 402da6 17 API calls 4008->4009 4010 401670 4009->4010 4011 406873 2 API calls 4010->4011 4012 401676 4011->4012 4013 402aeb 4014 402d84 17 API calls 4013->4014 4015 402af1 4014->4015 4016 40292e 4015->4016 4017 40657a 17 API calls 4015->4017 4017->4016 3286 4026ec 3287 402d84 17 API calls 3286->3287 3288 4026fb 3287->3288 3289 402745 ReadFile 3288->3289 3290 4060b0 ReadFile 3288->3290 3291 4027de 3288->3291 3293 402785 MultiByteToWideChar 3288->3293 3294 40283a 3288->3294 3296 4027ab SetFilePointer MultiByteToWideChar 3288->3296 3297 40284b 3288->3297 3299 402838 3288->3299 3289->3288 3289->3299 3290->3288 3291->3288 3291->3299 3300 40610e SetFilePointer 3291->3300 3293->3288 3309 406484 wsprintfW 3294->3309 3296->3288 3298 40286c SetFilePointer 3297->3298 3297->3299 3298->3299 3301 40612a 3300->3301 3304 406142 3300->3304 3302 4060b0 ReadFile 3301->3302 3303 406136 3302->3303 3303->3304 3305 406173 SetFilePointer 3303->3305 3306 40614b SetFilePointer 3303->3306 3304->3291 3305->3304 3306->3305 3307 406156 3306->3307 3308 4060df WriteFile 3307->3308 3308->3304 3309->3299 3556 40176f 3557 402da6 17 API calls 3556->3557 3558 401776 3557->3558 3559 401796 3558->3559 3560 40179e 3558->3560 3595 40653d lstrcpynW 3559->3595 3596 40653d lstrcpynW 3560->3596 3563 40179c 3567 4067c4 5 API calls 3563->3567 3564 4017a9 3565 405e0c 3 API calls 3564->3565 3566 4017af lstrcatW 3565->3566 3566->3563 3584 4017bb 3567->3584 3568 406873 2 API calls 3568->3584 3569 406008 2 API calls 3569->3584 3571 4017cd CompareFileTime 3571->3584 3572 40188d 3574 40559f 24 API calls 3572->3574 3573 401864 3575 40559f 24 API calls 3573->3575 3579 401879 3573->3579 3577 401897 3574->3577 3575->3579 3576 40653d lstrcpynW 3576->3584 3578 4032b4 31 API calls 3577->3578 3580 4018aa 3578->3580 3581 4018be SetFileTime 3580->3581 3582 4018d0 CloseHandle 3580->3582 3581->3582 3582->3579 3585 4018e1 3582->3585 3583 40657a 17 API calls 3583->3584 3584->3568 3584->3569 3584->3571 3584->3572 3584->3573 3584->3576 3584->3583 3590 405b9d MessageBoxIndirectW 3584->3590 3594 40602d GetFileAttributesW CreateFileW 3584->3594 3586 4018e6 3585->3586 3587 4018f9 3585->3587 3588 40657a 17 API calls 3586->3588 3589 40657a 17 API calls 3587->3589 3591 4018ee lstrcatW 3588->3591 3592 401901 3589->3592 3590->3584 3591->3592 3593 405b9d MessageBoxIndirectW 3592->3593 3593->3579 3594->3584 3595->3563 3596->3564 4018 401a72 4019 402d84 17 API calls 4018->4019 4020 401a7b 4019->4020 4021 402d84 17 API calls 4020->4021 4022 401a20 4021->4022 4023 401573 4024 401583 ShowWindow 4023->4024 4025 40158c 4023->4025 4024->4025 4026 402c2a 4025->4026 4027 40159a ShowWindow 4025->4027 4027->4026 4028 4023f4 4029 402da6 17 API calls 4028->4029 4030 402403 4029->4030 4031 402da6 17 API calls 4030->4031 4032 40240c 4031->4032 4033 402da6 17 API calls 4032->4033 4034 402416 GetPrivateProfileStringW 4033->4034 4035 4014f5 SetForegroundWindow 4036 402c2a 4035->4036 4037 401ff6 4038 402da6 17 API calls 4037->4038 4039 401ffd 4038->4039 4040 406873 2 API calls 4039->4040 4041 402003 4040->4041 4043 402014 4041->4043 4044 406484 wsprintfW 4041->4044 4044->4043 4045 401b77 4046 402da6 17 API calls 4045->4046 4047 401b7e 4046->4047 4048 402d84 17 API calls 4047->4048 4049 401b87 wsprintfW 4048->4049 4050 402c2a 4049->4050 4051 40167b 4052 402da6 17 API calls 4051->4052 4053 401682 4052->4053 4054 402da6 17 API calls 4053->4054 4055 40168b 4054->4055 4056 402da6 17 API calls 4055->4056 4057 401694 MoveFileW 4056->4057 4058 4016a7 4057->4058 4064 4016a0 4057->4064 4060 406873 2 API calls 4058->4060 4062 4022f6 4058->4062 4059 401423 24 API calls 4059->4062 4061 4016b6 4060->4061 4061->4062 4063 4062fd 36 API calls 4061->4063 4063->4064 4064->4059 4065 4019ff 4066 402da6 17 API calls 4065->4066 4067 401a06 4066->4067 4068 402da6 17 API calls 4067->4068 4069 401a0f 4068->4069 4070 401a16 lstrcmpiW 4069->4070 4071 401a28 lstrcmpW 4069->4071 4072 401a1c 4070->4072 4071->4072 4073 4022ff 4074 402da6 17 API calls 4073->4074 4075 402305 4074->4075 4076 402da6 17 API calls 4075->4076 4077 40230e 4076->4077 4078 402da6 17 API calls 4077->4078 4079 402317 4078->4079 4080 406873 2 API calls 4079->4080 4081 402320 4080->4081 4082 402331 lstrlenW lstrlenW 4081->4082 4083 402324 4081->4083 4085 40559f 24 API calls 4082->4085 4084 40559f 24 API calls 4083->4084 4087 40232c 4083->4087 4084->4087 4086 40236f SHFileOperationW 4085->4086 4086->4083 4086->4087 4088 401000 4089 401037 BeginPaint GetClientRect 4088->4089 4090 40100c DefWindowProcW 4088->4090 4092 4010f3 4089->4092 4095 401179 4090->4095 4093 401073 CreateBrushIndirect FillRect DeleteObject 4092->4093 4094 4010fc 4092->4094 4093->4092 4096 401102 CreateFontIndirectW 4094->4096 4097 401167 EndPaint 4094->4097 4096->4097 4098 401112 6 API calls 4096->4098 4097->4095 4098->4097 3154 401d81 3155 401d94 GetDlgItem 3154->3155 3156 401d87 3154->3156 3157 401d8e 3155->3157 3165 402d84 3156->3165 3159 401dd5 GetClientRect LoadImageW SendMessageW 3157->3159 3160 402da6 17 API calls 3157->3160 3162 401e33 3159->3162 3164 401e3f 3159->3164 3160->3159 3163 401e38 DeleteObject 3162->3163 3162->3164 3163->3164 3166 40657a 17 API calls 3165->3166 3167 402d99 3166->3167 3167->3157 4099 401503 4100 40150b 4099->4100 4102 40151e 4099->4102 4101 402d84 17 API calls 4100->4101 4101->4102 4103 402383 4104 40238a 4103->4104 4107 40239d 4103->4107 4105 40657a 17 API calls 4104->4105 4106 402397 4105->4106 4108 405b9d MessageBoxIndirectW 4106->4108 4108->4107 3217 402c05 SendMessageW 3218 402c2a 3217->3218 3219 402c1f InvalidateRect 3217->3219 3219->3218 4109 404f06 GetDlgItem GetDlgItem 4110 404f58 7 API calls 4109->4110 4116 40517d 4109->4116 4111 404ff2 SendMessageW 4110->4111 4112 404fff DeleteObject 4110->4112 4111->4112 4113 405008 4112->4113 4114 40503f 4113->4114 4117 40657a 17 API calls 4113->4117 4118 404499 18 API calls 4114->4118 4115 40525f 4119 40530b 4115->4119 4129 4052b8 SendMessageW 4115->4129 4149 405170 4115->4149 4116->4115 4120 4051ec 4116->4120 4163 404e54 SendMessageW 4116->4163 4123 405021 SendMessageW SendMessageW 4117->4123 4124 405053 4118->4124 4121 405315 SendMessageW 4119->4121 4122 40531d 4119->4122 4120->4115 4125 405251 SendMessageW 4120->4125 4121->4122 4131 405336 4122->4131 4132 40532f ImageList_Destroy 4122->4132 4147 405346 4122->4147 4123->4113 4128 404499 18 API calls 4124->4128 4125->4115 4126 404500 8 API calls 4130 40550c 4126->4130 4142 405064 4128->4142 4134 4052cd SendMessageW 4129->4134 4129->4149 4135 40533f GlobalFree 4131->4135 4131->4147 4132->4131 4133 4054c0 4138 4054d2 ShowWindow GetDlgItem ShowWindow 4133->4138 4133->4149 4137 4052e0 4134->4137 4135->4147 4136 40513f GetWindowLongW SetWindowLongW 4139 405158 4136->4139 4148 4052f1 SendMessageW 4137->4148 4138->4149 4140 405175 4139->4140 4141 40515d ShowWindow 4139->4141 4162 4044ce SendMessageW 4140->4162 4161 4044ce SendMessageW 4141->4161 4142->4136 4143 40513a 4142->4143 4146 4050b7 SendMessageW 4142->4146 4150 4050f5 SendMessageW 4142->4150 4151 405109 SendMessageW 4142->4151 4143->4136 4143->4139 4146->4142 4147->4133 4154 405381 4147->4154 4168 404ed4 4147->4168 4148->4119 4149->4126 4150->4142 4151->4142 4153 40548b 4155 405496 InvalidateRect 4153->4155 4158 4054a2 4153->4158 4156 4053af SendMessageW 4154->4156 4157 4053c5 4154->4157 4155->4158 4156->4157 4157->4153 4159 405439 SendMessageW SendMessageW 4157->4159 4158->4133 4177 404e0f 4158->4177 4159->4157 4161->4149 4162->4116 4164 404eb3 SendMessageW 4163->4164 4165 404e77 GetMessagePos ScreenToClient SendMessageW 4163->4165 4167 404eab 4164->4167 4166 404eb0 4165->4166 4165->4167 4166->4164 4167->4120 4180 40653d lstrcpynW 4168->4180 4170 404ee7 4181 406484 wsprintfW 4170->4181 4172 404ef1 4173 40140b 2 API calls 4172->4173 4174 404efa 4173->4174 4182 40653d lstrcpynW 4174->4182 4176 404f01 4176->4154 4183 404d46 4177->4183 4179 404e24 4179->4133 4180->4170 4181->4172 4182->4176 4184 404d5f 4183->4184 4185 40657a 17 API calls 4184->4185 4186 404dc3 4185->4186 4187 40657a 17 API calls 4186->4187 4188 404dce 4187->4188 4189 40657a 17 API calls 4188->4189 4190 404de4 lstrlenW wsprintfW SetDlgItemTextW 4189->4190 4190->4179 4191 404609 lstrlenW 4192 404628 4191->4192 4193 40462a WideCharToMultiByte 4191->4193 4192->4193 3220 40248a 3221 402da6 17 API calls 3220->3221 3222 40249c 3221->3222 3223 402da6 17 API calls 3222->3223 3224 4024a6 3223->3224 3237 402e36 3224->3237 3227 40292e 3228 4024de 3230 4024ea 3228->3230 3232 402d84 17 API calls 3228->3232 3229 402da6 17 API calls 3231 4024d4 lstrlenW 3229->3231 3233 402509 RegSetValueExW 3230->3233 3241 4032b4 3230->3241 3231->3228 3232->3230 3235 40251f RegCloseKey 3233->3235 3235->3227 3238 402e51 3237->3238 3261 4063d8 3238->3261 3242 4032cd 3241->3242 3243 4032fb 3242->3243 3268 4034e5 SetFilePointer 3242->3268 3265 4034cf 3243->3265 3247 403468 3249 4034aa 3247->3249 3252 40346c 3247->3252 3248 403318 GetTickCount 3253 403452 3248->3253 3257 403367 3248->3257 3250 4034cf ReadFile 3249->3250 3250->3253 3251 4034cf ReadFile 3251->3257 3252->3253 3254 4034cf ReadFile 3252->3254 3255 4060df WriteFile 3252->3255 3253->3233 3254->3252 3255->3252 3256 4033bd GetTickCount 3256->3257 3257->3251 3257->3253 3257->3256 3258 4033e2 MulDiv wsprintfW 3257->3258 3260 4060df WriteFile 3257->3260 3259 40559f 24 API calls 3258->3259 3259->3257 3260->3257 3262 4063e7 3261->3262 3263 4063f2 RegCreateKeyExW 3262->3263 3264 4024b6 3262->3264 3263->3264 3264->3227 3264->3228 3264->3229 3266 4060b0 ReadFile 3265->3266 3267 403306 3266->3267 3267->3247 3267->3248 3267->3253 3268->3243 4194 40498a 4195 4049b6 4194->4195 4196 4049c7 4194->4196 4255 405b81 GetDlgItemTextW 4195->4255 4197 4049d3 GetDlgItem 4196->4197 4204 404a32 4196->4204 4200 4049e7 4197->4200 4199 4049c1 4202 4067c4 5 API calls 4199->4202 4203 4049fb SetWindowTextW 4200->4203 4207 405eb7 4 API calls 4200->4207 4201 404b16 4253 404cc5 4201->4253 4257 405b81 GetDlgItemTextW 4201->4257 4202->4196 4208 404499 18 API calls 4203->4208 4204->4201 4209 40657a 17 API calls 4204->4209 4204->4253 4206 404500 8 API calls 4211 404cd9 4206->4211 4212 4049f1 4207->4212 4213 404a17 4208->4213 4214 404aa6 SHBrowseForFolderW 4209->4214 4210 404b46 4215 405f14 18 API calls 4210->4215 4212->4203 4219 405e0c 3 API calls 4212->4219 4216 404499 18 API calls 4213->4216 4214->4201 4217 404abe CoTaskMemFree 4214->4217 4218 404b4c 4215->4218 4220 404a25 4216->4220 4221 405e0c 3 API calls 4217->4221 4258 40653d lstrcpynW 4218->4258 4219->4203 4256 4044ce SendMessageW 4220->4256 4223 404acb 4221->4223 4226 404b02 SetDlgItemTextW 4223->4226 4230 40657a 17 API calls 4223->4230 4225 404a2b 4228 40690a 5 API calls 4225->4228 4226->4201 4227 404b63 4229 40690a 5 API calls 4227->4229 4228->4204 4241 404b6a 4229->4241 4231 404aea lstrcmpiW 4230->4231 4231->4226 4233 404afb lstrcatW 4231->4233 4232 404bab 4259 40653d lstrcpynW 4232->4259 4233->4226 4235 404bb2 4236 405eb7 4 API calls 4235->4236 4237 404bb8 GetDiskFreeSpaceW 4236->4237 4239 404bdc MulDiv 4237->4239 4243 404c03 4237->4243 4239->4243 4240 405e58 2 API calls 4240->4241 4241->4232 4241->4240 4241->4243 4242 404c74 4245 404c97 4242->4245 4247 40140b 2 API calls 4242->4247 4243->4242 4244 404e0f 20 API calls 4243->4244 4246 404c61 4244->4246 4260 4044bb KiUserCallbackDispatcher 4245->4260 4248 404c76 SetDlgItemTextW 4246->4248 4249 404c66 4246->4249 4247->4245 4248->4242 4251 404d46 20 API calls 4249->4251 4251->4242 4252 404cb3 4252->4253 4254 4048e3 SendMessageW 4252->4254 4253->4206 4254->4253 4255->4199 4256->4225 4257->4210 4258->4227 4259->4235 4260->4252 4261 40290b 4262 402da6 17 API calls 4261->4262 4263 402912 FindFirstFileW 4262->4263 4264 40293a 4263->4264 4267 402925 4263->4267 4269 406484 wsprintfW 4264->4269 4266 402943 4270 40653d lstrcpynW 4266->4270 4269->4266 4270->4267 4271 40190c 4272 401943 4271->4272 4273 402da6 17 API calls 4272->4273 4274 401948 4273->4274 4275 405c49 67 API calls 4274->4275 4276 401951 4275->4276 4277 40190f 4278 402da6 17 API calls 4277->4278 4279 401916 4278->4279 4280 405b9d MessageBoxIndirectW 4279->4280 4281 40191f 4280->4281 3597 402891 3598 402898 3597->3598 3599 402ba9 3597->3599 3600 402d84 17 API calls 3598->3600 3601 40289f 3600->3601 3602 4028ae SetFilePointer 3601->3602 3602->3599 3603 4028be 3602->3603 3605 406484 wsprintfW 3603->3605 3605->3599 4282 401491 4283 40559f 24 API calls 4282->4283 4284 401498 4283->4284 3606 403b12 3607 403b2a 3606->3607 3608 403b1c CloseHandle 3606->3608 3613 403b57 3607->3613 3608->3607 3611 405c49 67 API calls 3612 403b3b 3611->3612 3615 403b65 3613->3615 3614 403b2f 3614->3611 3615->3614 3616 403b6a FreeLibrary GlobalFree 3615->3616 3616->3614 3616->3616 4285 401f12 4286 402da6 17 API calls 4285->4286 4287 401f18 4286->4287 4288 402da6 17 API calls 4287->4288 4289 401f21 4288->4289 4290 402da6 17 API calls 4289->4290 4291 401f2a 4290->4291 4292 402da6 17 API calls 4291->4292 4293 401f33 4292->4293 4294 401423 24 API calls 4293->4294 4295 401f3a 4294->4295 4302 405b63 ShellExecuteExW 4295->4302 4297 401f82 4298 40292e 4297->4298 4299 4069b5 5 API calls 4297->4299 4300 401f9f CloseHandle 4299->4300 4300->4298 4302->4297 4303 405513 4304 405523 4303->4304 4305 405537 4303->4305 4306 405580 4304->4306 4307 405529 4304->4307 4308 40553f IsWindowVisible 4305->4308 4314 405556 4305->4314 4309 405585 CallWindowProcW 4306->4309 4310 4044e5 SendMessageW 4307->4310 4308->4306 4311 40554c 4308->4311 4312 405533 4309->4312 4310->4312 4313 404e54 5 API calls 4311->4313 4313->4314 4314->4309 4315 404ed4 4 API calls 4314->4315 4315->4306 4316 402f93 4317 402fa5 SetTimer 4316->4317 4318 402fbe 4316->4318 4317->4318 4319 403013 4318->4319 4320 402fd8 MulDiv wsprintfW SetWindowTextW SetDlgItemTextW 4318->4320 4320->4319 4321 401d17 4322 402d84 17 API calls 4321->4322 4323 401d1d IsWindow 4322->4323 4324 401a20 4323->4324 3643 403f9a 3644 403fb2 3643->3644 3645 404113 3643->3645 3644->3645 3646 403fbe 3644->3646 3647 404164 3645->3647 3648 404124 GetDlgItem GetDlgItem 3645->3648 3650 403fc9 SetWindowPos 3646->3650 3651 403fdc 3646->3651 3649 4041be 3647->3649 3660 401389 2 API calls 3647->3660 3652 404499 18 API calls 3648->3652 3653 4044e5 SendMessageW 3649->3653 3661 40410e 3649->3661 3650->3651 3654 403fe5 ShowWindow 3651->3654 3655 404027 3651->3655 3656 40414e SetClassLongW 3652->3656 3682 4041d0 3653->3682 3662 4040d1 3654->3662 3663 404005 GetWindowLongW 3654->3663 3657 404046 3655->3657 3658 40402f DestroyWindow 3655->3658 3659 40140b 2 API calls 3656->3659 3665 40404b SetWindowLongW 3657->3665 3666 40405c 3657->3666 3664 404422 3658->3664 3659->3647 3667 404196 3660->3667 3723 404500 3662->3723 3663->3662 3669 40401e ShowWindow 3663->3669 3664->3661 3676 404453 ShowWindow 3664->3676 3665->3661 3666->3662 3670 404068 GetDlgItem 3666->3670 3667->3649 3671 40419a SendMessageW 3667->3671 3669->3655 3674 404096 3670->3674 3675 404079 SendMessageW IsWindowEnabled 3670->3675 3671->3661 3672 40140b 2 API calls 3672->3682 3673 404424 DestroyWindow KiUserCallbackDispatcher 3673->3664 3678 4040a3 3674->3678 3680 4040ea SendMessageW 3674->3680 3681 4040b6 3674->3681 3688 40409b 3674->3688 3675->3661 3675->3674 3676->3661 3677 40657a 17 API calls 3677->3682 3678->3680 3678->3688 3680->3662 3683 4040d3 3681->3683 3684 4040be 3681->3684 3682->3661 3682->3672 3682->3673 3682->3677 3685 404499 18 API calls 3682->3685 3705 404364 DestroyWindow 3682->3705 3714 404499 3682->3714 3686 40140b 2 API calls 3683->3686 3687 40140b 2 API calls 3684->3687 3685->3682 3686->3688 3687->3688 3688->3662 3720 404472 3688->3720 3690 40424b GetDlgItem 3691 404260 3690->3691 3692 404268 ShowWindow KiUserCallbackDispatcher 3690->3692 3691->3692 3717 4044bb KiUserCallbackDispatcher 3692->3717 3694 404292 KiUserCallbackDispatcher 3699 4042a6 3694->3699 3695 4042ab GetSystemMenu EnableMenuItem SendMessageW 3696 4042db SendMessageW 3695->3696 3695->3699 3696->3699 3698 403f7b 18 API calls 3698->3699 3699->3695 3699->3698 3718 4044ce SendMessageW 3699->3718 3719 40653d lstrcpynW 3699->3719 3701 40430a lstrlenW 3702 40657a 17 API calls 3701->3702 3703 404320 SetWindowTextW 3702->3703 3704 401389 2 API calls 3703->3704 3704->3682 3705->3664 3706 40437e CreateDialogParamW 3705->3706 3706->3664 3707 4043b1 3706->3707 3708 404499 18 API calls 3707->3708 3709 4043bc GetDlgItem GetWindowRect ScreenToClient SetWindowPos 3708->3709 3710 401389 2 API calls 3709->3710 3711 404402 3710->3711 3711->3661 3712 40440a ShowWindow 3711->3712 3713 4044e5 SendMessageW 3712->3713 3713->3664 3715 40657a 17 API calls 3714->3715 3716 4044a4 SetDlgItemTextW 3715->3716 3716->3690 3717->3694 3718->3699 3719->3701 3721 404479 3720->3721 3722 40447f SendMessageW 3720->3722 3721->3722 3722->3662 3724 4045c3 3723->3724 3725 404518 GetWindowLongW 3723->3725 3724->3661 3725->3724 3726 40452d 3725->3726 3726->3724 3727 40455a GetSysColor 3726->3727 3728 40455d 3726->3728 3727->3728 3729 404563 SetTextColor 3728->3729 3730 40456d SetBkMode 3728->3730 3729->3730 3731 404585 GetSysColor 3730->3731 3732 40458b 3730->3732 3731->3732 3733 404592 SetBkColor 3732->3733 3734 40459c 3732->3734 3733->3734 3734->3724 3735 4045b6 CreateBrushIndirect 3734->3735 3736 4045af DeleteObject 3734->3736 3735->3724 3736->3735 3737 401b9b 3738 401ba8 3737->3738 3739 401bec 3737->3739 3744 401c31 3738->3744 3745 401bbf 3738->3745 3740 401bf1 3739->3740 3741 401c16 GlobalAlloc 3739->3741 3746 40239d 3740->3746 3756 40653d lstrcpynW 3740->3756 3742 40657a 17 API calls 3741->3742 3742->3744 3743 40657a 17 API calls 3747 402397 3743->3747 3744->3743 3744->3746 3757 40653d lstrcpynW 3745->3757 3752 405b9d MessageBoxIndirectW 3747->3752 3750 401c03 GlobalFree 3750->3746 3751 401bce 3758 40653d lstrcpynW 3751->3758 3752->3746 3754 401bdd 3759 40653d lstrcpynW 3754->3759 3756->3750 3757->3751 3758->3754 3759->3746 4325 40261c 4326 402da6 17 API calls 4325->4326 4327 402623 4326->4327 4330 40602d GetFileAttributesW CreateFileW 4327->4330 4329 40262f 4330->4329 3823 40259e 3824 402de6 17 API calls 3823->3824 3825 4025a8 3824->3825 3826 402d84 17 API calls 3825->3826 3827 4025b1 3826->3827 3828 4025d9 RegEnumValueW 3827->3828 3829 4025cd RegEnumKeyW 3827->3829 3830 40292e 3827->3830 3831 4025f5 RegCloseKey 3828->3831 3832 4025ee 3828->3832 3829->3831 3831->3830 3832->3831 4331 40149e 4332 4014ac PostQuitMessage 4331->4332 4333 40239d 4331->4333 4332->4333 4334 4015a3 4335 402da6 17 API calls 4334->4335 4336 4015aa SetFileAttributesW 4335->4336 4337 4015bc 4336->4337 3191 401fa4 3192 402da6 17 API calls 3191->3192 3193 401faa 3192->3193 3194 40559f 24 API calls 3193->3194 3195 401fb4 3194->3195 3204 405b20 CreateProcessW 3195->3204 3198 40292e 3201 401fcf 3202 401fdd CloseHandle 3201->3202 3212 406484 wsprintfW 3201->3212 3202->3198 3205 405b53 CloseHandle 3204->3205 3206 401fba 3204->3206 3205->3206 3206->3198 3206->3202 3207 4069b5 WaitForSingleObject 3206->3207 3208 4069cf 3207->3208 3209 4069e1 GetExitCodeProcess 3208->3209 3213 406946 3208->3213 3209->3201 3212->3202 3214 406963 PeekMessageW 3213->3214 3215 406973 WaitForSingleObject 3214->3215 3216 406959 DispatchMessageW 3214->3216 3215->3208 3216->3214 3269 40252a 3280 402de6 3269->3280 3272 402da6 17 API calls 3273 40253d 3272->3273 3274 402548 RegQueryValueExW 3273->3274 3279 40292e 3273->3279 3275 40256e RegCloseKey 3274->3275 3276 402568 3274->3276 3275->3279 3276->3275 3285 406484 wsprintfW 3276->3285 3281 402da6 17 API calls 3280->3281 3282 402dfd 3281->3282 3283 4063aa RegOpenKeyExW 3282->3283 3284 402534 3283->3284 3284->3272 3285->3275 4338 40202a 4339 402da6 17 API calls 4338->4339 4340 402031 4339->4340 4341 40690a 5 API calls 4340->4341 4342 402040 4341->4342 4343 40205c GlobalAlloc 4342->4343 4346 4020cc 4342->4346 4344 402070 4343->4344 4343->4346 4345 40690a 5 API calls 4344->4345 4347 402077 4345->4347 4348 40690a 5 API calls 4347->4348 4349 402081 4348->4349 4349->4346 4353 406484 wsprintfW 4349->4353 4351 4020ba 4354 406484 wsprintfW 4351->4354 4353->4351 4354->4346 4355 4021aa 4356 402da6 17 API calls 4355->4356 4357 4021b1 4356->4357 4358 402da6 17 API calls 4357->4358 4359 4021bb 4358->4359 4360 402da6 17 API calls 4359->4360 4361 4021c5 4360->4361 4362 402da6 17 API calls 4361->4362 4363 4021cf 4362->4363 4364 402da6 17 API calls 4363->4364 4365 4021d9 4364->4365 4366 402218 CoCreateInstance 4365->4366 4367 402da6 17 API calls 4365->4367 4370 402237 4366->4370 4367->4366 4368 401423 24 API calls 4369 4022f6 4368->4369 4370->4368 4370->4369 4371 403baa 4372 403bb5 4371->4372 4373 403bb9 4372->4373 4374 403bbc GlobalAlloc 4372->4374 4374->4373 3310 40352d SetErrorMode GetVersionExW 3311 4035b7 3310->3311 3312 40357f GetVersionExW 3310->3312 3313 403610 3311->3313 3314 40690a 5 API calls 3311->3314 3312->3311 3315 40689a 3 API calls 3313->3315 3314->3313 3316 403626 lstrlenA 3315->3316 3316->3313 3317 403636 3316->3317 3318 40690a 5 API calls 3317->3318 3319 40363d 3318->3319 3320 40690a 5 API calls 3319->3320 3321 403644 3320->3321 3322 40690a 5 API calls 3321->3322 3326 403650 #17 OleInitialize SHGetFileInfoW 3322->3326 3325 40369d GetCommandLineW 3401 40653d lstrcpynW 3325->3401 3400 40653d lstrcpynW 3326->3400 3328 4036af 3329 405e39 CharNextW 3328->3329 3330 4036d5 CharNextW 3329->3330 3342 4036e6 3330->3342 3331 4037e4 3332 4037f8 GetTempPathW 3331->3332 3402 4034fc 3332->3402 3334 403810 3336 403814 GetWindowsDirectoryW lstrcatW 3334->3336 3337 40386a DeleteFileW 3334->3337 3335 405e39 CharNextW 3335->3342 3338 4034fc 12 API calls 3336->3338 3412 40307d GetTickCount GetModuleFileNameW 3337->3412 3340 403830 3338->3340 3340->3337 3343 403834 GetTempPathW lstrcatW SetEnvironmentVariableW SetEnvironmentVariableW 3340->3343 3341 40387d 3345 403a59 ExitProcess CoUninitialize 3341->3345 3347 403932 3341->3347 3355 405e39 CharNextW 3341->3355 3342->3331 3342->3335 3344 4037e6 3342->3344 3346 4034fc 12 API calls 3343->3346 3496 40653d lstrcpynW 3344->3496 3349 403a69 3345->3349 3350 403a7e 3345->3350 3354 403862 3346->3354 3440 403bec 3347->3440 3501 405b9d 3349->3501 3352 403a86 GetCurrentProcess OpenProcessToken 3350->3352 3353 403afc ExitProcess 3350->3353 3358 403acc 3352->3358 3359 403a9d LookupPrivilegeValueW AdjustTokenPrivileges 3352->3359 3354->3337 3354->3345 3369 40389f 3355->3369 3362 40690a 5 API calls 3358->3362 3359->3358 3360 403941 3360->3345 3365 403ad3 3362->3365 3363 403908 3366 405f14 18 API calls 3363->3366 3364 403949 3368 405b08 5 API calls 3364->3368 3367 403ae8 ExitWindowsEx 3365->3367 3371 403af5 3365->3371 3370 403914 3366->3370 3367->3353 3367->3371 3372 40394e lstrcatW 3368->3372 3369->3363 3369->3364 3370->3345 3497 40653d lstrcpynW 3370->3497 3505 40140b 3371->3505 3373 40396a lstrcatW lstrcmpiW 3372->3373 3374 40395f lstrcatW 3372->3374 3373->3360 3376 40398a 3373->3376 3374->3373 3378 403996 3376->3378 3379 40398f 3376->3379 3382 405aeb 2 API calls 3378->3382 3381 405a6e 4 API calls 3379->3381 3380 403927 3498 40653d lstrcpynW 3380->3498 3384 403994 3381->3384 3385 40399b SetCurrentDirectoryW 3382->3385 3384->3385 3386 4039b8 3385->3386 3387 4039ad 3385->3387 3500 40653d lstrcpynW 3386->3500 3499 40653d lstrcpynW 3387->3499 3390 40657a 17 API calls 3391 4039fa DeleteFileW 3390->3391 3392 403a06 CopyFileW 3391->3392 3397 4039c5 3391->3397 3392->3397 3393 403a50 3395 4062fd 36 API calls 3393->3395 3394 4062fd 36 API calls 3394->3397 3395->3360 3396 40657a 17 API calls 3396->3397 3397->3390 3397->3393 3397->3394 3397->3396 3398 405b20 2 API calls 3397->3398 3399 403a3a CloseHandle 3397->3399 3398->3397 3399->3397 3400->3325 3401->3328 3403 4067c4 5 API calls 3402->3403 3405 403508 3403->3405 3404 403512 3404->3334 3405->3404 3406 405e0c 3 API calls 3405->3406 3407 40351a 3406->3407 3408 405aeb 2 API calls 3407->3408 3409 403520 3408->3409 3508 40605c 3409->3508 3512 40602d GetFileAttributesW CreateFileW 3412->3512 3414 4030bd 3432 4030cd 3414->3432 3513 40653d lstrcpynW 3414->3513 3416 4030e3 3417 405e58 2 API calls 3416->3417 3418 4030e9 3417->3418 3514 40653d lstrcpynW 3418->3514 3420 4030f4 GetFileSize 3421 4031ee 3420->3421 3439 40310b 3420->3439 3515 403019 3421->3515 3423 4031f7 3425 403227 GlobalAlloc 3423->3425 3423->3432 3527 4034e5 SetFilePointer 3423->3527 3424 4034cf ReadFile 3424->3439 3526 4034e5 SetFilePointer 3425->3526 3427 40325a 3429 403019 6 API calls 3427->3429 3429->3432 3430 403210 3433 4034cf ReadFile 3430->3433 3431 403242 3434 4032b4 31 API calls 3431->3434 3432->3341 3435 40321b 3433->3435 3437 40324e 3434->3437 3435->3425 3435->3432 3436 403019 6 API calls 3436->3439 3437->3432 3437->3437 3438 40328b SetFilePointer 3437->3438 3438->3432 3439->3421 3439->3424 3439->3427 3439->3432 3439->3436 3441 40690a 5 API calls 3440->3441 3442 403c00 3441->3442 3443 403c06 3442->3443 3444 403c18 3442->3444 3543 406484 wsprintfW 3443->3543 3445 40640b 3 API calls 3444->3445 3446 403c48 3445->3446 3448 403c67 lstrcatW 3446->3448 3450 40640b 3 API calls 3446->3450 3449 403c16 3448->3449 3528 403ec2 3449->3528 3450->3448 3453 405f14 18 API calls 3454 403c99 3453->3454 3455 403d2d 3454->3455 3457 40640b 3 API calls 3454->3457 3456 405f14 18 API calls 3455->3456 3458 403d33 3456->3458 3459 403ccb 3457->3459 3460 403d43 LoadImageW 3458->3460 3461 40657a 17 API calls 3458->3461 3459->3455 3464 403cec lstrlenW 3459->3464 3467 405e39 CharNextW 3459->3467 3462 403de9 3460->3462 3463 403d6a RegisterClassW 3460->3463 3461->3460 3466 40140b 2 API calls 3462->3466 3465 403da0 SystemParametersInfoW CreateWindowExW 3463->3465 3495 403df3 3463->3495 3468 403d20 3464->3468 3469 403cfa lstrcmpiW 3464->3469 3465->3462 3473 403def 3466->3473 3471 403ce9 3467->3471 3470 405e0c 3 API calls 3468->3470 3469->3468 3472 403d0a GetFileAttributesW 3469->3472 3475 403d26 3470->3475 3471->3464 3476 403d16 3472->3476 3474 403ec2 18 API calls 3473->3474 3473->3495 3477 403e00 3474->3477 3544 40653d lstrcpynW 3475->3544 3476->3468 3479 405e58 2 API calls 3476->3479 3480 403e0c ShowWindow 3477->3480 3481 403e8f 3477->3481 3479->3468 3483 40689a 3 API calls 3480->3483 3536 405672 OleInitialize 3481->3536 3485 403e24 3483->3485 3484 403e95 3486 403eb1 3484->3486 3487 403e99 3484->3487 3488 403e32 GetClassInfoW 3485->3488 3490 40689a 3 API calls 3485->3490 3489 40140b 2 API calls 3486->3489 3493 40140b 2 API calls 3487->3493 3487->3495 3491 403e46 GetClassInfoW RegisterClassW 3488->3491 3492 403e5c DialogBoxParamW 3488->3492 3489->3495 3490->3488 3491->3492 3494 40140b 2 API calls 3492->3494 3493->3495 3494->3495 3495->3360 3496->3332 3497->3380 3498->3347 3499->3386 3500->3397 3502 405bb2 3501->3502 3503 403a76 ExitProcess 3502->3503 3504 405bc6 MessageBoxIndirectW 3502->3504 3504->3503 3506 401389 2 API calls 3505->3506 3507 401420 3506->3507 3507->3353 3509 406069 GetTickCount GetTempFileNameW 3508->3509 3510 40352b 3509->3510 3511 40609f 3509->3511 3510->3334 3511->3509 3511->3510 3512->3414 3513->3416 3514->3420 3516 403022 3515->3516 3517 40303a 3515->3517 3518 403032 3516->3518 3519 40302b DestroyWindow 3516->3519 3520 403042 3517->3520 3521 40304a GetTickCount 3517->3521 3518->3423 3519->3518 3522 406946 2 API calls 3520->3522 3523 403058 CreateDialogParamW ShowWindow 3521->3523 3524 40307b 3521->3524 3525 403048 3522->3525 3523->3524 3524->3423 3525->3423 3526->3431 3527->3430 3529 403ed6 3528->3529 3545 406484 wsprintfW 3529->3545 3531 403f47 3546 403f7b 3531->3546 3533 403c77 3533->3453 3534 403f4c 3534->3533 3535 40657a 17 API calls 3534->3535 3535->3534 3549 4044e5 3536->3549 3538 405695 3542 4056bc 3538->3542 3552 401389 3538->3552 3539 4044e5 SendMessageW 3540 4056ce OleUninitialize 3539->3540 3540->3484 3542->3539 3543->3449 3544->3455 3545->3531 3547 40657a 17 API calls 3546->3547 3548 403f89 SetWindowTextW 3547->3548 3548->3534 3550 4044fd 3549->3550 3551 4044ee SendMessageW 3549->3551 3550->3538 3551->3550 3554 401390 3552->3554 3553 4013fe 3553->3538 3554->3553 3555 4013cb MulDiv SendMessageW 3554->3555 3555->3554 4375 401a30 4376 402da6 17 API calls 4375->4376 4377 401a39 ExpandEnvironmentStringsW 4376->4377 4378 401a4d 4377->4378 4380 401a60 4377->4380 4379 401a52 lstrcmpW 4378->4379 4378->4380 4379->4380 4386 4023b2 4387 4023c0 4386->4387 4388 4023ba 4386->4388 4390 4023ce 4387->4390 4391 402da6 17 API calls 4387->4391 4389 402da6 17 API calls 4388->4389 4389->4387 4392 402da6 17 API calls 4390->4392 4394 4023dc 4390->4394 4391->4390 4392->4394 4393 402da6 17 API calls 4395 4023e5 WritePrivateProfileStringW 4393->4395 4394->4393 4396 402434 4397 402467 4396->4397 4398 40243c 4396->4398 4399 402da6 17 API calls 4397->4399 4400 402de6 17 API calls 4398->4400 4401 40246e 4399->4401 4402 402443 4400->4402 4407 402e64 4401->4407 4404 402da6 17 API calls 4402->4404 4405 40247b 4402->4405 4406 402454 RegDeleteValueW RegCloseKey 4404->4406 4406->4405 4408 402e71 4407->4408 4409 402e78 4407->4409 4408->4405 4409->4408 4411 402ea9 4409->4411 4412 4063aa RegOpenKeyExW 4411->4412 4413 402ed7 4412->4413 4414 402ee7 RegEnumValueW 4413->4414 4415 402f0a 4413->4415 4422 402f81 4413->4422 4414->4415 4416 402f71 RegCloseKey 4414->4416 4415->4416 4417 402f46 RegEnumKeyW 4415->4417 4418 402f4f RegCloseKey 4415->4418 4421 402ea9 6 API calls 4415->4421 4416->4422 4417->4415 4417->4418 4419 40690a 5 API calls 4418->4419 4420 402f5f 4419->4420 4420->4422 4423 402f63 RegDeleteKeyW 4420->4423 4421->4415 4422->4408 4423->4422 4424 401735 4425 402da6 17 API calls 4424->4425 4426 40173c SearchPathW 4425->4426 4427 401757 4426->4427 4428 401d38 4429 402d84 17 API calls 4428->4429 4430 401d3f 4429->4430 4431 402d84 17 API calls 4430->4431 4432 401d4b GetDlgItem 4431->4432 4433 402638 4432->4433 4434 4014b8 4435 4014be 4434->4435 4436 401389 2 API calls 4435->4436 4437 4014c6 4436->4437 4438 40263e 4439 402652 4438->4439 4440 40266d 4438->4440 4441 402d84 17 API calls 4439->4441 4442 402672 4440->4442 4443 40269d 4440->4443 4450 402659 4441->4450 4444 402da6 17 API calls 4442->4444 4445 402da6 17 API calls 4443->4445 4447 402679 4444->4447 4446 4026a4 lstrlenW 4445->4446 4446->4450 4455 40655f WideCharToMultiByte 4447->4455 4449 40268d lstrlenA 4449->4450 4451 4026d1 4450->4451 4452 4026e7 4450->4452 4454 40610e 5 API calls 4450->4454 4451->4452 4453 4060df WriteFile 4451->4453 4453->4452 4454->4451 4455->4449

                                                                                                                                                                                                                                            Executed Functions

                                                                                                                                                                                                                                            Function 0040352D Relevance: 84.4, APIs: 34, Strings: 14, Instructions: 450stringfilecomCOMMON
                                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                                            control_flow_graph 0 40352d-40357d SetErrorMode GetVersionExW 1 4035b7-4035be 0->1 2 40357f-4035b3 GetVersionExW 0->2 3 4035c0 1->3 4 4035c8-403608 1->4 2->1 3->4 5 40360a-403612 call 40690a 4->5 6 40361b 4->6 5->6 11 403614 5->11 8 403620-403634 call 40689a lstrlenA 6->8 13 403636-403652 call 40690a * 3 8->13 11->6 20 403663-4036c5 #17 OleInitialize SHGetFileInfoW call 40653d GetCommandLineW call 40653d 13->20 21 403654-40365a 13->21 28 4036c7-4036c9 20->28 29 4036ce-4036e1 call 405e39 CharNextW 20->29 21->20 25 40365c 21->25 25->20 28->29 32 4037d8-4037de 29->32 33 4037e4 32->33 34 4036e6-4036ec 32->34 37 4037f8-403812 GetTempPathW call 4034fc 33->37 35 4036f5-4036fb 34->35 36 4036ee-4036f3 34->36 38 403702-403706 35->38 39 4036fd-403701 35->39 36->35 36->36 47 403814-403832 GetWindowsDirectoryW lstrcatW call 4034fc 37->47 48 40386a-403882 DeleteFileW call 40307d 37->48 41 4037c6-4037d4 call 405e39 38->41 42 40370c-403712 38->42 39->38 41->32 59 4037d6-4037d7 41->59 45 403714-40371b 42->45 46 40372c-403765 42->46 52 403722 45->52 53 40371d-403720 45->53 54 403781-4037bb 46->54 55 403767-40376c 46->55 47->48 62 403834-403864 GetTempPathW lstrcatW SetEnvironmentVariableW * 2 call 4034fc 47->62 64 403888-40388e 48->64 65 403a59-403a67 ExitProcess CoUninitialize 48->65 52->46 53->46 53->52 57 4037c3-4037c5 54->57 58 4037bd-4037c1 54->58 55->54 61 40376e-403776 55->61 57->41 58->57 63 4037e6-4037f3 call 40653d 58->63 59->32 66 403778-40377b 61->66 67 40377d 61->67 62->48 62->65 63->37 69 403894-4038a7 call 405e39 64->69 70 403935-40393c call 403bec 64->70 72 403a69-403a78 call 405b9d ExitProcess 65->72 73 403a7e-403a84 65->73 66->54 66->67 67->54 88 4038f9-403906 69->88 89 4038a9-4038de 69->89 84 403941-403944 70->84 75 403a86-403a9b GetCurrentProcess OpenProcessToken 73->75 76 403afc-403b04 73->76 81 403acc-403ada call 40690a 75->81 82 403a9d-403ac6 LookupPrivilegeValueW AdjustTokenPrivileges 75->82 85 403b06 76->85 86 403b09-403b0c ExitProcess 76->86 95 403ae8-403af3 ExitWindowsEx 81->95 96 403adc-403ae6 81->96 82->81 84->65 85->86 90 403908-403916 call 405f14 88->90 91 403949-40395d call 405b08 lstrcatW 88->91 93 4038e0-4038e4 89->93 90->65 106 40391c-403932 call 40653d * 2 90->106 104 40396a-403984 lstrcatW lstrcmpiW 91->104 105 40395f-403965 lstrcatW 91->105 98 4038e6-4038eb 93->98 99 4038ed-4038f5 93->99 95->76 102 403af5-403af7 call 40140b 95->102 96->95 96->102 98->99 100 4038f7 98->100 99->93 99->100 100->88 102->76 109 403a57 104->109 110 40398a-40398d 104->110 105->104 106->70 109->65 112 403996 call 405aeb 110->112 113 40398f-403994 call 405a6e 110->113 119 40399b-4039ab SetCurrentDirectoryW 112->119 113->119 121 4039b8-4039e4 call 40653d 119->121 122 4039ad-4039b3 call 40653d 119->122 126 4039e9-403a04 call 40657a DeleteFileW 121->126 122->121 129 403a44-403a4e 126->129 130 403a06-403a16 CopyFileW 126->130 129->126 132 403a50-403a52 call 4062fd 129->132 130->129 131 403a18-403a38 call 4062fd call 40657a call 405b20 130->131 131->129 140 403a3a-403a41 CloseHandle 131->140 132->109 140->129
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • SetErrorMode.KERNEL32(00008001), ref: 00403550
                                                                                                                                                                                                                                            • GetVersionExW.KERNEL32(?), ref: 00403579
                                                                                                                                                                                                                                            • GetVersionExW.KERNEL32(0000011C), ref: 00403590
                                                                                                                                                                                                                                            • lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 00403627
                                                                                                                                                                                                                                            • #17.COMCTL32(00000007,00000009,0000000B), ref: 00403663
                                                                                                                                                                                                                                            • OleInitialize.OLE32(00000000), ref: 0040366A
                                                                                                                                                                                                                                            • SHGetFileInfoW.SHELL32(0042B228,00000000,?,000002B4,00000000), ref: 00403688
                                                                                                                                                                                                                                            • GetCommandLineW.KERNEL32(00433F00,NSIS Error), ref: 0040369D
                                                                                                                                                                                                                                            • CharNextW.USER32(00000000,00440000,00000020,00440000,00000000), ref: 004036D6
                                                                                                                                                                                                                                            • GetTempPathW.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,00000000,?), ref: 00403809
                                                                                                                                                                                                                                            • GetWindowsDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB), ref: 0040381A
                                                                                                                                                                                                                                            • lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 00403826
                                                                                                                                                                                                                                            • GetTempPathW.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp), ref: 0040383A
                                                                                                                                                                                                                                            • lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low), ref: 00403842
                                                                                                                                                                                                                                            • SetEnvironmentVariableW.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low), ref: 00403853
                                                                                                                                                                                                                                            • SetEnvironmentVariableW.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\), ref: 0040385B
                                                                                                                                                                                                                                            • DeleteFileW.KERNEL32(1033), ref: 0040386F
                                                                                                                                                                                                                                            • lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu,00440000,00000000,?), ref: 00403956
                                                                                                                                                                                                                                            • lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,0040A26C,C:\Users\user\AppData\Local\Temp\,~nsu,00440000,00000000,?), ref: 00403965
                                                                                                                                                                                                                                              • Part of subcall function 00405AEB: CreateDirectoryW.KERNEL32(?,00000000,00403520,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403810), ref: 00405AF1
                                                                                                                                                                                                                                            • lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,00440000,00000000,?), ref: 00403970
                                                                                                                                                                                                                                            • lstrcmpiW.KERNEL32(C:\Users\user\AppData\Local\Temp\,00441800,C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,00440000,00000000,?), ref: 0040397C
                                                                                                                                                                                                                                            • SetCurrentDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\), ref: 0040399C
                                                                                                                                                                                                                                            • DeleteFileW.KERNEL32(0042AA28,0042AA28,?,C:\Users\user\AppData\Local\Temp\nswC086.tmp,?), ref: 004039FB
                                                                                                                                                                                                                                            • CopyFileW.KERNEL32(C:\Users\user\Desktop\Setup.exe,0042AA28,00000001), ref: 00403A0E
                                                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000,0042AA28,0042AA28,?,0042AA28,00000000), ref: 00403A3B
                                                                                                                                                                                                                                            • ExitProcess.KERNEL32(?), ref: 00403A59
                                                                                                                                                                                                                                            • CoUninitialize.COMBASE(?), ref: 00403A5E
                                                                                                                                                                                                                                            • ExitProcess.KERNEL32 ref: 00403A78
                                                                                                                                                                                                                                            • GetCurrentProcess.KERNEL32(00000028,?), ref: 00403A8C
                                                                                                                                                                                                                                            • OpenProcessToken.ADVAPI32(00000000), ref: 00403A93
                                                                                                                                                                                                                                            • LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403AA7
                                                                                                                                                                                                                                            • AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 00403AC6
                                                                                                                                                                                                                                            • ExitWindowsEx.USER32(00000002,80040002), ref: 00403AEB
                                                                                                                                                                                                                                            • ExitProcess.KERNEL32 ref: 00403B0C
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000000.00000002.2413490347.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413437029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413539237.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Processlstrcat$ExitFile$Directory$CurrentDeleteEnvironmentPathTempTokenVariableVersionWindows$AdjustCharCloseCommandCopyCreateErrorHandleInfoInitializeLineLookupModeNextOpenPrivilegePrivilegesUninitializeValuelstrcmpilstrlen
                                                                                                                                                                                                                                            • String ID: .tmp$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\nswC086.tmp$C:\Users\user\Desktop\Setup.exe$Error launching installer$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
                                                                                                                                                                                                                                            • API String ID: 2292928366-610882135
                                                                                                                                                                                                                                            • Opcode ID: a9950f16e1a4a62c6ded3d55c7a98e4382dcb346a085109a7b13f69721f27fd6
                                                                                                                                                                                                                                            • Instruction ID: 4d4dc0a58e4858e72561def8a0259f0227da8af974c10a5ea2b310ef4b80d7a5
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: a9950f16e1a4a62c6ded3d55c7a98e4382dcb346a085109a7b13f69721f27fd6
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 66E10670A00214AADB10AFB59D45BAF3AB8EF4470AF14847FF545B22D1DB7C8A41CB6D
                                                                                                                                                                                                                                            Function 004056DE Relevance: 66.8, APIs: 36, Strings: 2, Instructions: 284windowclipboardmemoryCOMMON
                                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                                            control_flow_graph 141 4056de-4056f9 142 405888-40588f 141->142 143 4056ff-4057c6 GetDlgItem * 3 call 4044ce call 404e27 GetClientRect GetSystemMetrics SendMessageW * 2 141->143 145 405891-4058b3 GetDlgItem CreateThread CloseHandle 142->145 146 4058b9-4058c6 142->146 165 4057e4-4057e7 143->165 166 4057c8-4057e2 SendMessageW * 2 143->166 145->146 148 4058e4-4058ee 146->148 149 4058c8-4058ce 146->149 150 4058f0-4058f6 148->150 151 405944-405948 148->151 153 4058d0-4058df ShowWindow * 2 call 4044ce 149->153 154 405909-405912 call 404500 149->154 155 4058f8-405904 call 404472 150->155 156 40591e-40592e ShowWindow 150->156 151->154 159 40594a-405950 151->159 153->148 162 405917-40591b 154->162 155->154 163 405930-405939 call 40559f 156->163 164 40593e-40593f call 404472 156->164 159->154 167 405952-405965 SendMessageW 159->167 163->164 164->151 170 4057f7-40580e call 404499 165->170 171 4057e9-4057f5 SendMessageW 165->171 166->165 172 405a67-405a69 167->172 173 40596b-405996 CreatePopupMenu call 40657a AppendMenuW 167->173 180 405810-405824 ShowWindow 170->180 181 405844-405865 GetDlgItem SendMessageW 170->181 171->170 172->162 178 405998-4059a8 GetWindowRect 173->178 179 4059ab-4059c0 TrackPopupMenu 173->179 178->179 179->172 182 4059c6-4059dd 179->182 183 405833 180->183 184 405826-405831 ShowWindow 180->184 181->172 185 40586b-405883 SendMessageW * 2 181->185 186 4059e2-4059fd SendMessageW 182->186 187 405839-40583f call 4044ce 183->187 184->187 185->172 186->186 188 4059ff-405a22 OpenClipboard EmptyClipboard GlobalAlloc GlobalLock 186->188 187->181 190 405a24-405a4b SendMessageW 188->190 190->190 191 405a4d-405a61 GlobalUnlock SetClipboardData CloseClipboard 190->191 191->172
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • GetDlgItem.USER32(?,00000403), ref: 0040573C
                                                                                                                                                                                                                                            • GetDlgItem.USER32(?,000003EE), ref: 0040574B
                                                                                                                                                                                                                                            • GetClientRect.USER32(?,?), ref: 00405788
                                                                                                                                                                                                                                            • GetSystemMetrics.USER32(00000002), ref: 0040578F
                                                                                                                                                                                                                                            • SendMessageW.USER32(?,00001061,00000000,?), ref: 004057B0
                                                                                                                                                                                                                                            • SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004057C1
                                                                                                                                                                                                                                            • SendMessageW.USER32(?,00001001,00000000,00000110), ref: 004057D4
                                                                                                                                                                                                                                            • SendMessageW.USER32(?,00001026,00000000,00000110), ref: 004057E2
                                                                                                                                                                                                                                            • SendMessageW.USER32(?,00001024,00000000,?), ref: 004057F5
                                                                                                                                                                                                                                            • ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 00405817
                                                                                                                                                                                                                                            • ShowWindow.USER32(?,00000008), ref: 0040582B
                                                                                                                                                                                                                                            • GetDlgItem.USER32(?,000003EC), ref: 0040584C
                                                                                                                                                                                                                                            • SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 0040585C
                                                                                                                                                                                                                                            • SendMessageW.USER32(00000000,00000409,00000000,?), ref: 00405875
                                                                                                                                                                                                                                            • SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 00405881
                                                                                                                                                                                                                                            • GetDlgItem.USER32(?,000003F8), ref: 0040575A
                                                                                                                                                                                                                                              • Part of subcall function 004044CE: SendMessageW.USER32(00000028,?,00000001,004042F9), ref: 004044DC
                                                                                                                                                                                                                                            • GetDlgItem.USER32(?,000003EC), ref: 0040589E
                                                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,Function_00005672,00000000), ref: 004058AC
                                                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 004058B3
                                                                                                                                                                                                                                            • ShowWindow.USER32(00000000), ref: 004058D7
                                                                                                                                                                                                                                            • ShowWindow.USER32(00030438,00000008), ref: 004058DC
                                                                                                                                                                                                                                            • ShowWindow.USER32(00000008), ref: 00405926
                                                                                                                                                                                                                                            • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040595A
                                                                                                                                                                                                                                            • CreatePopupMenu.USER32 ref: 0040596B
                                                                                                                                                                                                                                            • AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 0040597F
                                                                                                                                                                                                                                            • GetWindowRect.USER32(?,?), ref: 0040599F
                                                                                                                                                                                                                                            • TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004059B8
                                                                                                                                                                                                                                            • SendMessageW.USER32(?,00001073,00000000,?), ref: 004059F0
                                                                                                                                                                                                                                            • OpenClipboard.USER32(00000000), ref: 00405A00
                                                                                                                                                                                                                                            • EmptyClipboard.USER32 ref: 00405A06
                                                                                                                                                                                                                                            • GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405A12
                                                                                                                                                                                                                                            • GlobalLock.KERNEL32(00000000), ref: 00405A1C
                                                                                                                                                                                                                                            • SendMessageW.USER32(?,00001073,00000000,?), ref: 00405A30
                                                                                                                                                                                                                                            • GlobalUnlock.KERNEL32(00000000), ref: 00405A50
                                                                                                                                                                                                                                            • SetClipboardData.USER32(0000000D,00000000), ref: 00405A5B
                                                                                                                                                                                                                                            • CloseClipboard.USER32 ref: 00405A61
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000000.00000002.2413490347.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413437029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413539237.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
                                                                                                                                                                                                                                            • String ID: {$ep
                                                                                                                                                                                                                                            • API String ID: 590372296-2242023888
                                                                                                                                                                                                                                            • Opcode ID: c8ef7bbbe888f33c7642292c9829dc0fe895fcac448e4408b73d3b9779d96911
                                                                                                                                                                                                                                            • Instruction ID: 6b97441d6f4cfe62a880681573964a63c423f2dd70b2063085686802d9cc5617
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: c8ef7bbbe888f33c7642292c9829dc0fe895fcac448e4408b73d3b9779d96911
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: C8B169B1900608FFDB119FA0DD85AAE7B79FB44355F00803AFA41BA1A0C7755E51DF58
                                                                                                                                                                                                                                            Function 00405C49 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 148filestringCOMMON
                                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                                            control_flow_graph 498 405c49-405c6f call 405f14 501 405c71-405c83 DeleteFileW 498->501 502 405c88-405c8f 498->502 503 405e05-405e09 501->503 504 405c91-405c93 502->504 505 405ca2-405cb2 call 40653d 502->505 506 405db3-405db8 504->506 507 405c99-405c9c 504->507 513 405cc1-405cc2 call 405e58 505->513 514 405cb4-405cbf lstrcatW 505->514 506->503 509 405dba-405dbd 506->509 507->505 507->506 511 405dc7-405dcf call 406873 509->511 512 405dbf-405dc5 509->512 511->503 522 405dd1-405de5 call 405e0c call 405c01 511->522 512->503 516 405cc7-405ccb 513->516 514->516 518 405cd7-405cdd lstrcatW 516->518 519 405ccd-405cd5 516->519 521 405ce2-405cfe lstrlenW FindFirstFileW 518->521 519->518 519->521 523 405d04-405d0c 521->523 524 405da8-405dac 521->524 538 405de7-405dea 522->538 539 405dfd-405e00 call 40559f 522->539 526 405d2c-405d40 call 40653d 523->526 527 405d0e-405d16 523->527 524->506 529 405dae 524->529 540 405d42-405d4a 526->540 541 405d57-405d62 call 405c01 526->541 530 405d18-405d20 527->530 531 405d8b-405d9b FindNextFileW 527->531 529->506 530->526 534 405d22-405d2a 530->534 531->523 537 405da1-405da2 FindClose 531->537 534->526 534->531 537->524 538->512 544 405dec-405dfb call 40559f call 4062fd 538->544 539->503 540->531 545 405d4c-405d55 call 405c49 540->545 549 405d83-405d86 call 40559f 541->549 550 405d64-405d67 541->550 544->503 545->531 549->531 553 405d69-405d79 call 40559f call 4062fd 550->553 554 405d7b-405d81 550->554 553->531 554->531
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • DeleteFileW.KERNEL32(?,?,76233420,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405C72
                                                                                                                                                                                                                                            • lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\nsw9A21.tmp\*.*,\*.*,C:\Users\user\AppData\Local\Temp\nsw9A21.tmp\*.*,?,?,76233420,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405CBA
                                                                                                                                                                                                                                            • lstrcatW.KERNEL32(?,0040A014,?,C:\Users\user\AppData\Local\Temp\nsw9A21.tmp\*.*,?,?,76233420,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405CDD
                                                                                                                                                                                                                                            • lstrlenW.KERNEL32(?,?,0040A014,?,C:\Users\user\AppData\Local\Temp\nsw9A21.tmp\*.*,?,?,76233420,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405CE3
                                                                                                                                                                                                                                            • FindFirstFileW.KERNEL32(C:\Users\user\AppData\Local\Temp\nsw9A21.tmp\*.*,?,?,?,0040A014,?,C:\Users\user\AppData\Local\Temp\nsw9A21.tmp\*.*,?,?,76233420,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405CF3
                                                                                                                                                                                                                                            • FindNextFileW.KERNELBASE(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405D93
                                                                                                                                                                                                                                            • FindClose.KERNEL32(00000000), ref: 00405DA2
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000000.00000002.2413490347.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413437029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413539237.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
                                                                                                                                                                                                                                            • String ID: .$.$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\nsw9A21.tmp\*.*$\*.*
                                                                                                                                                                                                                                            • API String ID: 2035342205-3798462137
                                                                                                                                                                                                                                            • Opcode ID: d4824498ca5d4646401654330336f54dc3516ea2401a274e156101c2699109e4
                                                                                                                                                                                                                                            • Instruction ID: 8b2ee76931e9ba666d6dc67a471f1b560bbb00ea1adf29c264b32972d7114dcf
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: d4824498ca5d4646401654330336f54dc3516ea2401a274e156101c2699109e4
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 3D41A130900A14BADB216B65CC8DABF7678DF81714F14817FF841B21D1D77C4A819EAE
                                                                                                                                                                                                                                            Function 00406873 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14fileCOMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • FindFirstFileW.KERNEL32(?,004302B8,C:\,00405F5D,C:\,C:\,00000000,C:\,C:\, 4#v,?,C:\Users\user\AppData\Local\Temp\,00405C69,?,76233420,C:\Users\user\AppData\Local\Temp\), ref: 0040687E
                                                                                                                                                                                                                                            • FindClose.KERNEL32(00000000), ref: 0040688A
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000000.00000002.2413490347.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413437029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413539237.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Find$CloseFileFirst
                                                                                                                                                                                                                                            • String ID: C:\
                                                                                                                                                                                                                                            • API String ID: 2295610775-3404278061
                                                                                                                                                                                                                                            • Opcode ID: 86d0f84efe5cb21a5e65899ed37e92679b9de560e532c409a12d624e9ae3e839
                                                                                                                                                                                                                                            • Instruction ID: 67599a3b69382adcf67454a25bfea179debcebd0a6e2e92eb77ede12202c023a
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 86d0f84efe5cb21a5e65899ed37e92679b9de560e532c409a12d624e9ae3e839
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: C3D012325192205FC3402B386E0C84B7A989F16331726CB76B4AAF51E0D7388C7387BD
                                                                                                                                                                                                                                            Function 00403F9A Relevance: 61.6, APIs: 34, Strings: 1, Instructions: 357windowstringCOMMON
                                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                                            control_flow_graph 192 403f9a-403fac 193 403fb2-403fb8 192->193 194 404113-404122 192->194 193->194 195 403fbe-403fc7 193->195 196 404171-404186 194->196 197 404124-40416c GetDlgItem * 2 call 404499 SetClassLongW call 40140b 194->197 200 403fc9-403fd6 SetWindowPos 195->200 201 403fdc-403fe3 195->201 198 4041c6-4041cb call 4044e5 196->198 199 404188-40418b 196->199 197->196 214 4041d0-4041eb 198->214 203 40418d-404198 call 401389 199->203 204 4041be-4041c0 199->204 200->201 206 403fe5-403fff ShowWindow 201->206 207 404027-40402d 201->207 203->204 228 40419a-4041b9 SendMessageW 203->228 204->198 213 404466 204->213 215 404100-40410e call 404500 206->215 216 404005-404018 GetWindowLongW 206->216 209 404046-404049 207->209 210 40402f-404041 DestroyWindow 207->210 220 40404b-404057 SetWindowLongW 209->220 221 40405c-404062 209->221 217 404443-404449 210->217 219 404468-40446f 213->219 224 4041f4-4041fa 214->224 225 4041ed-4041ef call 40140b 214->225 215->219 216->215 226 40401e-404021 ShowWindow 216->226 217->213 231 40444b-404451 217->231 220->219 221->215 227 404068-404077 GetDlgItem 221->227 232 404200-40420b 224->232 233 404424-40443d DestroyWindow KiUserCallbackDispatcher 224->233 225->224 226->207 235 404096-404099 227->235 236 404079-404090 SendMessageW IsWindowEnabled 227->236 228->219 231->213 237 404453-40445c ShowWindow 231->237 232->233 234 404211-40425e call 40657a call 404499 * 3 GetDlgItem 232->234 233->217 264 404260-404265 234->264 265 404268-4042a4 ShowWindow KiUserCallbackDispatcher call 4044bb KiUserCallbackDispatcher 234->265 239 40409b-40409c 235->239 240 40409e-4040a1 235->240 236->213 236->235 237->213 242 4040cc-4040d1 call 404472 239->242 243 4040a3-4040a9 240->243 244 4040af-4040b4 240->244 242->215 247 4040ea-4040fa SendMessageW 243->247 248 4040ab-4040ad 243->248 244->247 249 4040b6-4040bc 244->249 247->215 248->242 252 4040d3-4040dc call 40140b 249->252 253 4040be-4040c4 call 40140b 249->253 252->215 262 4040de-4040e8 252->262 260 4040ca 253->260 260->242 262->260 264->265 268 4042a6-4042a7 265->268 269 4042a9 265->269 270 4042ab-4042d9 GetSystemMenu EnableMenuItem SendMessageW 268->270 269->270 271 4042db-4042ec SendMessageW 270->271 272 4042ee 270->272 273 4042f4-404333 call 4044ce call 403f7b call 40653d lstrlenW call 40657a SetWindowTextW call 401389 271->273 272->273 273->214 284 404339-40433b 273->284 284->214 285 404341-404345 284->285 286 404364-404378 DestroyWindow 285->286 287 404347-40434d 285->287 286->217 289 40437e-4043ab CreateDialogParamW 286->289 287->213 288 404353-404359 287->288 288->214 290 40435f 288->290 289->217 291 4043b1-404408 call 404499 GetDlgItem GetWindowRect ScreenToClient SetWindowPos call 401389 289->291 290->213 291->213 296 40440a-40441d ShowWindow call 4044e5 291->296 298 404422 296->298 298->217
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403FD6
                                                                                                                                                                                                                                            • ShowWindow.USER32(?), ref: 00403FF6
                                                                                                                                                                                                                                            • GetWindowLongW.USER32(?,000000F0), ref: 00404008
                                                                                                                                                                                                                                            • ShowWindow.USER32(?,00000004), ref: 00404021
                                                                                                                                                                                                                                            • DestroyWindow.USER32 ref: 00404035
                                                                                                                                                                                                                                            • SetWindowLongW.USER32(?,00000000,00000000), ref: 0040404E
                                                                                                                                                                                                                                            • GetDlgItem.USER32(?,?), ref: 0040406D
                                                                                                                                                                                                                                            • SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00404081
                                                                                                                                                                                                                                            • IsWindowEnabled.USER32(00000000), ref: 00404088
                                                                                                                                                                                                                                            • GetDlgItem.USER32(?,00000001), ref: 00404133
                                                                                                                                                                                                                                            • GetDlgItem.USER32(?,00000002), ref: 0040413D
                                                                                                                                                                                                                                            • SetClassLongW.USER32(?,000000F2,?), ref: 00404157
                                                                                                                                                                                                                                            • SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 004041A8
                                                                                                                                                                                                                                            • GetDlgItem.USER32(?,00000003), ref: 0040424E
                                                                                                                                                                                                                                            • ShowWindow.USER32(00000000,?), ref: 0040426F
                                                                                                                                                                                                                                            • KiUserCallbackDispatcher.NTDLL(?,?), ref: 00404281
                                                                                                                                                                                                                                            • KiUserCallbackDispatcher.NTDLL(?,?), ref: 0040429C
                                                                                                                                                                                                                                            • GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 004042B2
                                                                                                                                                                                                                                            • EnableMenuItem.USER32(00000000), ref: 004042B9
                                                                                                                                                                                                                                            • SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 004042D1
                                                                                                                                                                                                                                            • SendMessageW.USER32(?,00000401,00000002,00000000), ref: 004042E4
                                                                                                                                                                                                                                            • lstrlenW.KERNEL32(0042D268,?,0042D268,00000000), ref: 0040430E
                                                                                                                                                                                                                                            • SetWindowTextW.USER32(?,0042D268), ref: 00404322
                                                                                                                                                                                                                                            • ShowWindow.USER32(?,0000000A), ref: 00404456
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000000.00000002.2413490347.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413437029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413539237.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Window$Item$MessageSendShow$Long$CallbackDispatcherMenuUser$ClassDestroyEnableEnabledSystemTextlstrlen
                                                                                                                                                                                                                                            • String ID: ep
                                                                                                                                                                                                                                            • API String ID: 3964124867-2898164290
                                                                                                                                                                                                                                            • Opcode ID: e7f11a10533a611f3fe78e549378f399a66bd747c21cf404ab37e5123baac86e
                                                                                                                                                                                                                                            • Instruction ID: 19e8ffe36521fda3862950d2389d84f1ef0c133ac5ff71005f69e3a94542e2f3
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: e7f11a10533a611f3fe78e549378f399a66bd747c21cf404ab37e5123baac86e
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: DDC1A1B1A00704ABDB206F61EE49E2B3A68FB84746F15053EF741B61F1CB799841DB2D
                                                                                                                                                                                                                                            Function 00403BEC Relevance: 42.2, APIs: 13, Strings: 11, Instructions: 215stringregistryCOMMON
                                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                                            control_flow_graph 299 403bec-403c04 call 40690a 302 403c06-403c16 call 406484 299->302 303 403c18-403c4f call 40640b 299->303 312 403c72-403c9b call 403ec2 call 405f14 302->312 308 403c51-403c62 call 40640b 303->308 309 403c67-403c6d lstrcatW 303->309 308->309 309->312 317 403ca1-403ca6 312->317 318 403d2d-403d35 call 405f14 312->318 317->318 319 403cac-403cd4 call 40640b 317->319 324 403d43-403d68 LoadImageW 318->324 325 403d37-403d3e call 40657a 318->325 319->318 326 403cd6-403cda 319->326 328 403de9-403df1 call 40140b 324->328 329 403d6a-403d9a RegisterClassW 324->329 325->324 330 403cec-403cf8 lstrlenW 326->330 331 403cdc-403ce9 call 405e39 326->331 343 403df3-403df6 328->343 344 403dfb-403e06 call 403ec2 328->344 332 403da0-403de4 SystemParametersInfoW CreateWindowExW 329->332 333 403eb8 329->333 337 403d20-403d28 call 405e0c call 40653d 330->337 338 403cfa-403d08 lstrcmpiW 330->338 331->330 332->328 336 403eba-403ec1 333->336 337->318 338->337 342 403d0a-403d14 GetFileAttributesW 338->342 347 403d16-403d18 342->347 348 403d1a-403d1b call 405e58 342->348 343->336 352 403e0c-403e26 ShowWindow call 40689a 344->352 353 403e8f-403e90 call 405672 344->353 347->337 347->348 348->337 360 403e32-403e44 GetClassInfoW 352->360 361 403e28-403e2d call 40689a 352->361 356 403e95-403e97 353->356 358 403eb1-403eb3 call 40140b 356->358 359 403e99-403e9f 356->359 358->333 359->343 362 403ea5-403eac call 40140b 359->362 365 403e46-403e56 GetClassInfoW RegisterClassW 360->365 366 403e5c-403e7f DialogBoxParamW call 40140b 360->366 361->360 362->343 365->366 370 403e84-403e8d call 403b3c 366->370 370->336
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                              • Part of subcall function 0040690A: GetModuleHandleA.KERNEL32(?,00000020,?,0040363D,0000000B), ref: 0040691C
                                                                                                                                                                                                                                              • Part of subcall function 0040690A: GetProcAddress.KERNEL32(00000000,?), ref: 00406937
                                                                                                                                                                                                                                            • lstrcatW.KERNEL32(1033,0042D268,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042D268,00000000,00000002,76233420,C:\Users\user\AppData\Local\Temp\,?,00000000,?), ref: 00403C6D
                                                                                                                                                                                                                                            • lstrlenW.KERNEL32(Remove folder: ,?,?,?,Remove folder: ,00000000,00440800,1033,0042D268,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042D268,00000000,00000002,76233420), ref: 00403CED
                                                                                                                                                                                                                                            • lstrcmpiW.KERNEL32(?,.exe,Remove folder: ,?,?,?,Remove folder: ,00000000,00440800,1033,0042D268,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042D268,00000000), ref: 00403D00
                                                                                                                                                                                                                                            • GetFileAttributesW.KERNEL32(Remove folder: ,?,00000000,?), ref: 00403D0B
                                                                                                                                                                                                                                            • LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,00440800), ref: 00403D54
                                                                                                                                                                                                                                              • Part of subcall function 00406484: wsprintfW.USER32 ref: 00406491
                                                                                                                                                                                                                                            • RegisterClassW.USER32(00433EA0), ref: 00403D91
                                                                                                                                                                                                                                            • SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403DA9
                                                                                                                                                                                                                                            • CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403DDE
                                                                                                                                                                                                                                            • ShowWindow.USER32(00000005,00000000,?,00000000,?), ref: 00403E14
                                                                                                                                                                                                                                            • GetClassInfoW.USER32(00000000,RichEdit20W,00433EA0), ref: 00403E40
                                                                                                                                                                                                                                            • GetClassInfoW.USER32(00000000,RichEdit,00433EA0), ref: 00403E4D
                                                                                                                                                                                                                                            • RegisterClassW.USER32(00433EA0), ref: 00403E56
                                                                                                                                                                                                                                            • DialogBoxParamW.USER32(?,00000000,00403F9A,00000000), ref: 00403E75
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000000.00000002.2413490347.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413437029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413539237.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
                                                                                                                                                                                                                                            • String ID: .DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Temp\$Control Panel\Desktop\ResourceLocale$Remove folder: $RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
                                                                                                                                                                                                                                            • API String ID: 1975747703-3587615903
                                                                                                                                                                                                                                            • Opcode ID: b5e4680adf6fab30abf8c31c9b96982c96c1f128c8b6e65fe06ccfbd791f05a2
                                                                                                                                                                                                                                            • Instruction ID: 6cc527b2f10929733706d009ff8c1d9b21e511251dd9cb17fe62514cef47010a
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: b5e4680adf6fab30abf8c31c9b96982c96c1f128c8b6e65fe06ccfbd791f05a2
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: F561A670140300BED721AF66ED46F2B3A6CEB84B5AF40453FF945B62E2CB7D59018A6D
                                                                                                                                                                                                                                            Function 0040307D Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 181memoryCOMMON
                                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                                            control_flow_graph 373 40307d-4030cb GetTickCount GetModuleFileNameW call 40602d 376 4030d7-403105 call 40653d call 405e58 call 40653d GetFileSize 373->376 377 4030cd-4030d2 373->377 385 4031f0-4031fe call 403019 376->385 386 40310b 376->386 378 4032ad-4032b1 377->378 392 403200-403203 385->392 393 403253-403258 385->393 388 403110-403127 386->388 390 403129 388->390 391 40312b-403134 call 4034cf 388->391 390->391 399 40325a-403262 call 403019 391->399 400 40313a-403141 391->400 395 403205-40321d call 4034e5 call 4034cf 392->395 396 403227-403251 GlobalAlloc call 4034e5 call 4032b4 392->396 393->378 395->393 419 40321f-403225 395->419 396->393 424 403264-403275 396->424 399->393 404 403143-403157 call 405fe8 400->404 405 4031bd-4031c1 400->405 410 4031cb-4031d1 404->410 422 403159-403160 404->422 409 4031c3-4031ca call 403019 405->409 405->410 409->410 415 4031e0-4031e8 410->415 416 4031d3-4031dd call 4069f7 410->416 415->388 423 4031ee 415->423 416->415 419->393 419->396 422->410 428 403162-403169 422->428 423->385 425 403277 424->425 426 40327d-403282 424->426 425->426 429 403283-403289 426->429 428->410 430 40316b-403172 428->430 429->429 431 40328b-4032a6 SetFilePointer call 405fe8 429->431 430->410 432 403174-40317b 430->432 436 4032ab 431->436 432->410 433 40317d-40319d 432->433 433->393 435 4031a3-4031a7 433->435 437 4031a9-4031ad 435->437 438 4031af-4031b7 435->438 436->378 437->423 437->438 438->410 439 4031b9-4031bb 438->439 439->410
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • GetTickCount.KERNEL32 ref: 0040308E
                                                                                                                                                                                                                                            • GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\Setup.exe,00000400,?,?,?,?,?,0040387D,?), ref: 004030AA
                                                                                                                                                                                                                                              • Part of subcall function 0040602D: GetFileAttributesW.KERNEL32(00000003,004030BD,C:\Users\user\Desktop\Setup.exe,80000000,00000003,?,?,?,?,?,0040387D,?), ref: 00406031
                                                                                                                                                                                                                                              • Part of subcall function 0040602D: CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000,?,?,?,?,?,0040387D,?), ref: 00406053
                                                                                                                                                                                                                                            • GetFileSize.KERNEL32(00000000,00000000,00444000,00000000,00441800,00441800,C:\Users\user\Desktop\Setup.exe,C:\Users\user\Desktop\Setup.exe,80000000,00000003,?,?,?,?,?,0040387D), ref: 004030F6
                                                                                                                                                                                                                                            • GlobalAlloc.KERNEL32(00000040,}8@,?,?,?,?,?,0040387D,?), ref: 0040322C
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000000.00000002.2413490347.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413437029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413539237.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
                                                                                                                                                                                                                                            • String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop\Setup.exe$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft$}8@
                                                                                                                                                                                                                                            • API String ID: 2803837635-2477270287
                                                                                                                                                                                                                                            • Opcode ID: b2925046ebf4ee23c20be954f21b6b8de3b8febbf6f0f410cc7df6a070a5bb34
                                                                                                                                                                                                                                            • Instruction ID: 750c061bb954c4555836cecba7cc54c639b148d890841a972b43b12454d44aa7
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: b2925046ebf4ee23c20be954f21b6b8de3b8febbf6f0f410cc7df6a070a5bb34
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 7951B571904204AFDB10AF65ED42B9E7EACAB48756F14807BF904B62D1C77C9F408B9D
                                                                                                                                                                                                                                            Function 0040657A Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 196stringCOMMON
                                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                                            control_flow_graph 440 40657a-406585 441 406587-406596 440->441 442 406598-4065ae 440->442 441->442 443 4065b0-4065bd 442->443 444 4065c6-4065cf 442->444 443->444 445 4065bf-4065c2 443->445 446 4065d5 444->446 447 4067aa-4067b5 444->447 445->444 448 4065da-4065e7 446->448 449 4067c0-4067c1 447->449 450 4067b7-4067bb call 40653d 447->450 448->447 451 4065ed-4065f6 448->451 450->449 453 406788 451->453 454 4065fc-406639 451->454 457 406796-406799 453->457 458 40678a-406794 453->458 455 40672c-406731 454->455 456 40663f-406646 454->456 462 406733-406739 455->462 463 406764-406769 455->463 459 406648-40664a 456->459 460 40664b-40664d 456->460 461 40679b-4067a4 457->461 458->461 459->460 464 40668a-40668d 460->464 465 40664f-406676 call 40640b 460->465 461->447 468 4065d7 461->468 469 406749-406755 call 40653d 462->469 470 40673b-406747 call 406484 462->470 466 406778-406786 lstrlenW 463->466 467 40676b-406773 call 40657a 463->467 474 40669d-4066a0 464->474 475 40668f-40669b GetSystemDirectoryW 464->475 485 406713-406717 465->485 486 40667c-406685 call 40657a 465->486 466->461 467->466 468->448 478 40675a-406760 469->478 470->478 481 4066a2-4066b0 GetWindowsDirectoryW 474->481 482 406709-40670b 474->482 480 40670d-406711 475->480 478->466 483 406762 478->483 480->485 487 406724-40672a call 4067c4 480->487 481->482 482->480 484 4066b2-4066ba 482->484 483->487 491 4066d1-4066e7 SHGetSpecialFolderLocation 484->491 492 4066bc-4066c5 484->492 485->487 488 406719-40671f lstrcatW 485->488 486->480 487->466 488->487 493 406705 491->493 494 4066e9-406703 SHGetPathFromIDListW CoTaskMemFree 491->494 497 4066cd-4066cf 492->497 493->482 494->480 494->493 497->480 497->491
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • GetSystemDirectoryW.KERNEL32(Remove folder: ,00000400), ref: 00406695
                                                                                                                                                                                                                                            • GetWindowsDirectoryW.KERNEL32(Remove folder: ,00000400,00000000,Remove folder: C:\Users\user\AppData\Local\Temp\nsw9A21.tmp\,?,004055D6,Remove folder: C:\Users\user\AppData\Local\Temp\nsw9A21.tmp\,00000000,00000000,00424420,762323A0), ref: 004066A8
                                                                                                                                                                                                                                            • lstrcatW.KERNEL32(Remove folder: ,\Microsoft\Internet Explorer\Quick Launch), ref: 0040671F
                                                                                                                                                                                                                                            • lstrlenW.KERNEL32(Remove folder: ,00000000,Remove folder: C:\Users\user\AppData\Local\Temp\nsw9A21.tmp\,?,004055D6,Remove folder: C:\Users\user\AppData\Local\Temp\nsw9A21.tmp\,00000000), ref: 00406779
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000000.00000002.2413490347.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413437029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413539237.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Directory$SystemWindowslstrcatlstrlen
                                                                                                                                                                                                                                            • String ID: C:\Users\user\AppData\Local\Temp\nswC086.tmp$Remove folder: $Remove folder: C:\Users\user\AppData\Local\Temp\nsw9A21.tmp\$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
                                                                                                                                                                                                                                            • API String ID: 4260037668-571476871
                                                                                                                                                                                                                                            • Opcode ID: 71c82525ba0a65243e1f04eb87fe478d36a31e86dfe70ef8bf5ce9ddd18f012c
                                                                                                                                                                                                                                            • Instruction ID: 685928b229c5d1fd60d609eb920d771e11fa4d776b5b66b0bad6c944a0f90ddf
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 71c82525ba0a65243e1f04eb87fe478d36a31e86dfe70ef8bf5ce9ddd18f012c
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 1D61D131900205EADB209F64DD80BAE77A5EF54318F22813BE907B72D0D77D99A1CB5D
                                                                                                                                                                                                                                            Function 004032B4 Relevance: 19.4, APIs: 4, Strings: 7, Instructions: 166COMMON
                                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                                            control_flow_graph 562 4032b4-4032cb 563 4032d4-4032dd 562->563 564 4032cd 562->564 565 4032e6-4032eb 563->565 566 4032df 563->566 564->563 567 4032fb-403308 call 4034cf 565->567 568 4032ed-4032f6 call 4034e5 565->568 566->565 572 4034bd 567->572 573 40330e-403312 567->573 568->567 574 4034bf-4034c0 572->574 575 403468-40346a 573->575 576 403318-403361 GetTickCount 573->576 579 4034c8-4034cc 574->579 577 4034aa-4034ad 575->577 578 40346c-40346f 575->578 580 4034c5 576->580 581 403367-40336f 576->581 585 4034b2-4034bb call 4034cf 577->585 586 4034af 577->586 578->580 582 403471 578->582 580->579 583 403371 581->583 584 403374-403382 call 4034cf 581->584 588 403474-40347a 582->588 583->584 584->572 596 403388-403391 584->596 585->572 594 4034c2 585->594 586->585 591 40347c 588->591 592 40347e-40348c call 4034cf 588->592 591->592 592->572 599 40348e-40349a call 4060df 592->599 594->580 598 403397-4033b7 call 406a65 596->598 604 403460-403462 598->604 605 4033bd-4033d0 GetTickCount 598->605 606 403464-403466 599->606 607 40349c-4034a6 599->607 604->574 608 4033d2-4033da 605->608 609 40341b-40341d 605->609 606->574 607->588 614 4034a8 607->614 610 4033e2-403418 MulDiv wsprintfW call 40559f 608->610 611 4033dc-4033e0 608->611 612 403454-403458 609->612 613 40341f-403423 609->613 610->609 611->609 611->610 612->581 618 40345e 612->618 616 403425-40342c call 4060df 613->616 617 40343a-403445 613->617 614->580 622 403431-403433 616->622 621 403448-40344c 617->621 618->580 621->598 623 403452 621->623 622->606 624 403435-403438 622->624 623->580 624->621
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000000.00000002.2413490347.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413437029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413539237.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: CountTick$wsprintf
                                                                                                                                                                                                                                            • String ID: *B$ DB$ A$ A$... %d%%$tClientRect$}8@
                                                                                                                                                                                                                                            • API String ID: 551687249-400812307
                                                                                                                                                                                                                                            • Opcode ID: 3bb00b159343602b5baf8216f2e6fd7ccfc314744640e4b330e170589aabe739
                                                                                                                                                                                                                                            • Instruction ID: 54ab186c05730647c672001b6e56d135182c7b51176e178f40f708a1e84a381e
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 3bb00b159343602b5baf8216f2e6fd7ccfc314744640e4b330e170589aabe739
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: E251BD31810219EBCF11DF65DA44B9E7BB8AF05756F10827BE804BB2C1D7789E44CBA9
                                                                                                                                                                                                                                            Function 0040176F Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 145stringtimeCOMMON
                                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                                            control_flow_graph 625 40176f-401794 call 402da6 call 405e83 630 401796-40179c call 40653d 625->630 631 40179e-4017b0 call 40653d call 405e0c lstrcatW 625->631 636 4017b5-4017b6 call 4067c4 630->636 631->636 640 4017bb-4017bf 636->640 641 4017c1-4017cb call 406873 640->641 642 4017f2-4017f5 640->642 649 4017dd-4017ef 641->649 650 4017cd-4017db CompareFileTime 641->650 643 4017f7-4017f8 call 406008 642->643 644 4017fd-401819 call 40602d 642->644 643->644 652 40181b-40181e 644->652 653 40188d-4018b6 call 40559f call 4032b4 644->653 649->642 650->649 654 401820-40185e call 40653d * 2 call 40657a call 40653d call 405b9d 652->654 655 40186f-401879 call 40559f 652->655 665 4018b8-4018bc 653->665 666 4018be-4018ca SetFileTime 653->666 654->640 687 401864-401865 654->687 667 401882-401888 655->667 665->666 669 4018d0-4018db CloseHandle 665->669 666->669 670 402c33 667->670 673 4018e1-4018e4 669->673 674 402c2a-402c2d 669->674 675 402c35-402c39 670->675 677 4018e6-4018f7 call 40657a lstrcatW 673->677 678 4018f9-4018fc call 40657a 673->678 674->670 684 401901-4023a2 call 405b9d 677->684 678->684 684->674 684->675 687->667 689 401867-401868 687->689 689->655
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • lstrcatW.KERNEL32(00000000,00000000,get,00441000,?,?,00000031), ref: 004017B0
                                                                                                                                                                                                                                            • CompareFileTime.KERNEL32(-00000014,?,get,get,00000000,00000000,get,00441000,?,?,00000031), ref: 004017D5
                                                                                                                                                                                                                                              • Part of subcall function 0040653D: lstrcpynW.KERNEL32(?,?,00000400,0040369D,00433F00,NSIS Error), ref: 0040654A
                                                                                                                                                                                                                                              • Part of subcall function 0040559F: lstrlenW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsw9A21.tmp\,00000000,00424420,762323A0,?,?,?,?,?,?,?,?,?,00403418,00000000,?), ref: 004055D7
                                                                                                                                                                                                                                              • Part of subcall function 0040559F: lstrlenW.KERNEL32(00403418,Remove folder: C:\Users\user\AppData\Local\Temp\nsw9A21.tmp\,00000000,00424420,762323A0,?,?,?,?,?,?,?,?,?,00403418,00000000), ref: 004055E7
                                                                                                                                                                                                                                              • Part of subcall function 0040559F: lstrcatW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsw9A21.tmp\,00403418,00403418,Remove folder: C:\Users\user\AppData\Local\Temp\nsw9A21.tmp\,00000000,00424420,762323A0), ref: 004055FA
                                                                                                                                                                                                                                              • Part of subcall function 0040559F: SetWindowTextW.USER32(Remove folder: C:\Users\user\AppData\Local\Temp\nsw9A21.tmp\,Remove folder: C:\Users\user\AppData\Local\Temp\nsw9A21.tmp\), ref: 0040560C
                                                                                                                                                                                                                                              • Part of subcall function 0040559F: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405632
                                                                                                                                                                                                                                              • Part of subcall function 0040559F: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040564C
                                                                                                                                                                                                                                              • Part of subcall function 0040559F: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040565A
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000000.00000002.2413490347.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413437029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413539237.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
                                                                                                                                                                                                                                            • String ID: C:\Users\user\AppData\Local\Temp\nsw9A21.tmp$C:\Users\user\AppData\Local\Temp\nsw9A21.tmp\inetc.dll$get
                                                                                                                                                                                                                                            • API String ID: 1941528284-3311394954
                                                                                                                                                                                                                                            • Opcode ID: f7e64eeb5d3c4bf8a05a3440747446d68def3c8d7aa8c7c6583b7de4a42550af
                                                                                                                                                                                                                                            • Instruction ID: 1e3f5e060805a06bac003644be00ba5f3fef1f2c353f2d3d357c0a6c5ca497fd
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: f7e64eeb5d3c4bf8a05a3440747446d68def3c8d7aa8c7c6583b7de4a42550af
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: F4419371900108BACF11BFB5DD85DAE7A79EF45768B20423FF422B10E2D63C8A91966D
                                                                                                                                                                                                                                            Function 0040559F Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 72stringwindowCOMMON
                                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                                            control_flow_graph 691 40559f-4055b4 692 4055ba-4055cb 691->692 693 40566b-40566f 691->693 694 4055d6-4055e2 lstrlenW 692->694 695 4055cd-4055d1 call 40657a 692->695 697 4055e4-4055f4 lstrlenW 694->697 698 4055ff-405603 694->698 695->694 697->693 699 4055f6-4055fa lstrcatW 697->699 700 405612-405616 698->700 701 405605-40560c SetWindowTextW 698->701 699->698 702 405618-40565a SendMessageW * 3 700->702 703 40565c-40565e 700->703 701->700 702->703 703->693 704 405660-405663 703->704 704->693
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • lstrlenW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsw9A21.tmp\,00000000,00424420,762323A0,?,?,?,?,?,?,?,?,?,00403418,00000000,?), ref: 004055D7
                                                                                                                                                                                                                                            • lstrlenW.KERNEL32(00403418,Remove folder: C:\Users\user\AppData\Local\Temp\nsw9A21.tmp\,00000000,00424420,762323A0,?,?,?,?,?,?,?,?,?,00403418,00000000), ref: 004055E7
                                                                                                                                                                                                                                            • lstrcatW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsw9A21.tmp\,00403418,00403418,Remove folder: C:\Users\user\AppData\Local\Temp\nsw9A21.tmp\,00000000,00424420,762323A0), ref: 004055FA
                                                                                                                                                                                                                                            • SetWindowTextW.USER32(Remove folder: C:\Users\user\AppData\Local\Temp\nsw9A21.tmp\,Remove folder: C:\Users\user\AppData\Local\Temp\nsw9A21.tmp\), ref: 0040560C
                                                                                                                                                                                                                                            • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405632
                                                                                                                                                                                                                                            • SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040564C
                                                                                                                                                                                                                                            • SendMessageW.USER32(?,00001013,?,00000000), ref: 0040565A
                                                                                                                                                                                                                                              • Part of subcall function 0040657A: lstrcatW.KERNEL32(Remove folder: ,\Microsoft\Internet Explorer\Quick Launch), ref: 0040671F
                                                                                                                                                                                                                                              • Part of subcall function 0040657A: lstrlenW.KERNEL32(Remove folder: ,00000000,Remove folder: C:\Users\user\AppData\Local\Temp\nsw9A21.tmp\,?,004055D6,Remove folder: C:\Users\user\AppData\Local\Temp\nsw9A21.tmp\,00000000), ref: 00406779
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000000.00000002.2413490347.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413437029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413539237.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: MessageSendlstrlen$lstrcat$TextWindow
                                                                                                                                                                                                                                            • String ID: Remove folder: C:\Users\user\AppData\Local\Temp\nsw9A21.tmp\
                                                                                                                                                                                                                                            • API String ID: 1495540970-748924507
                                                                                                                                                                                                                                            • Opcode ID: 195069dcc2a5024ac29c7a45bf60c8768b6efe327543dfefb6c4dd5180e0e504
                                                                                                                                                                                                                                            • Instruction ID: 138a2a903332092674924c4fce2a37a83712bc812e9b86ab44911e1df8857bb6
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 195069dcc2a5024ac29c7a45bf60c8768b6efe327543dfefb6c4dd5180e0e504
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: C1219071900558BACF11AFA9DD84DDFBF75EF45354F14803AF904B22A0C7794A419F68
                                                                                                                                                                                                                                            Function 004026EC Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153fileCOMMON
                                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                                            control_flow_graph 705 4026ec-402705 call 402d84 708 402c2a-402c2d 705->708 709 40270b-402712 705->709 710 402c33-402c39 708->710 711 402714 709->711 712 402717-40271a 709->712 711->712 713 402720-40272f call 40649d 712->713 714 40287e-402886 712->714 713->714 718 402735 713->718 714->708 719 40273b-40273f 718->719 720 4027d4-4027d7 719->720 721 402745-402760 ReadFile 719->721 723 4027d9-4027dc 720->723 724 4027ef-4027ff call 4060b0 720->724 721->714 722 402766-40276b 721->722 722->714 726 402771-40277f 722->726 723->724 727 4027de-4027e9 call 40610e 723->727 724->714 733 402801 724->733 730 402785-402797 MultiByteToWideChar 726->730 731 40283a-402846 call 406484 726->731 727->714 727->724 730->733 734 402799-40279c 730->734 731->710 736 402804-402807 733->736 737 40279e-4027a9 734->737 736->731 739 402809-40280e 736->739 737->736 740 4027ab-4027d0 SetFilePointer MultiByteToWideChar 737->740 741 402810-402815 739->741 742 40284b-40284f 739->742 740->737 743 4027d2 740->743 741->742 746 402817-40282a 741->746 744 402851-402855 742->744 745 40286c-402878 SetFilePointer 742->745 743->733 747 402857-40285b 744->747 748 40285d-40286a 744->748 745->714 746->714 749 40282c-402832 746->749 747->745 747->748 748->714 749->719 750 402838 749->750 750->714
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • ReadFile.KERNEL32(?,?,?,?), ref: 00402758
                                                                                                                                                                                                                                            • MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 00402793
                                                                                                                                                                                                                                            • SetFilePointer.KERNEL32(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 004027B6
                                                                                                                                                                                                                                            • MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 004027CC
                                                                                                                                                                                                                                              • Part of subcall function 0040610E: SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 00406124
                                                                                                                                                                                                                                            • SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 00402878
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000000.00000002.2413490347.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413437029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413539237.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: File$Pointer$ByteCharMultiWide$Read
                                                                                                                                                                                                                                            • String ID: 9
                                                                                                                                                                                                                                            • API String ID: 163830602-2366072709
                                                                                                                                                                                                                                            • Opcode ID: 05ec9e9945247294569ed32eb70c3e484d87f4f0290394ce4997a83a7f1e58dd
                                                                                                                                                                                                                                            • Instruction ID: 36eba916602f65c1f8b814f2f26102ddc75cc08ed25eda7b441ea0696c55e726
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 05ec9e9945247294569ed32eb70c3e484d87f4f0290394ce4997a83a7f1e58dd
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: C551E975D00219AADF20EF95CA89AAEBB79FF04304F10817BE541B62D4D7B49D82CB58
                                                                                                                                                                                                                                            Function 0040689A Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36libraryCOMMON
                                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                                            control_flow_graph 751 40689a-4068ba GetSystemDirectoryW 752 4068bc 751->752 753 4068be-4068c0 751->753 752->753 754 4068d1-4068d3 753->754 755 4068c2-4068cb 753->755 757 4068d4-406907 wsprintfW LoadLibraryExW 754->757 755->754 756 4068cd-4068cf 755->756 756->757
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004068B1
                                                                                                                                                                                                                                            • wsprintfW.USER32 ref: 004068EC
                                                                                                                                                                                                                                            • LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 00406900
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000000.00000002.2413490347.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413437029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413539237.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: DirectoryLibraryLoadSystemwsprintf
                                                                                                                                                                                                                                            • String ID: %s%S.dll$UXTHEME$\
                                                                                                                                                                                                                                            • API String ID: 2200240437-1946221925
                                                                                                                                                                                                                                            • Opcode ID: 70474fd7a4f9c0ba06a591290262a653731ba096fd3a0e6ffa6d52d828e9795f
                                                                                                                                                                                                                                            • Instruction ID: 21628a1c63ce2f140fdd4d546058f3b0ba52bdb51e88dcb335987c0e659eada7
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 70474fd7a4f9c0ba06a591290262a653731ba096fd3a0e6ffa6d52d828e9795f
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: D0F0F671511119ABDB10BB64DD0DF9B376CBF00305F10847AA646F10D0EB7CDA68CBA8
                                                                                                                                                                                                                                            Function 00405F14 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 47stringCOMMON
                                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                                            control_flow_graph 758 405f14-405f2f call 40653d call 405eb7 763 405f31-405f33 758->763 764 405f35-405f42 call 4067c4 758->764 765 405f8d-405f8f 763->765 768 405f52-405f56 764->768 769 405f44-405f4a 764->769 770 405f6c-405f75 lstrlenW 768->770 769->763 771 405f4c-405f50 769->771 772 405f77-405f8b call 405e0c GetFileAttributesW 770->772 773 405f58-405f5f call 406873 770->773 771->763 771->768 772->765 778 405f61-405f64 773->778 779 405f66-405f67 call 405e58 773->779 778->763 778->779 779->770
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                              • Part of subcall function 0040653D: lstrcpynW.KERNEL32(?,?,00000400,0040369D,00433F00,NSIS Error), ref: 0040654A
                                                                                                                                                                                                                                              • Part of subcall function 00405EB7: CharNextW.USER32(?,?,C:\,?,00405F2B,C:\,C:\, 4#v,?,C:\Users\user\AppData\Local\Temp\,00405C69,?,76233420,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405EC5
                                                                                                                                                                                                                                              • Part of subcall function 00405EB7: CharNextW.USER32(00000000), ref: 00405ECA
                                                                                                                                                                                                                                              • Part of subcall function 00405EB7: CharNextW.USER32(00000000), ref: 00405EE2
                                                                                                                                                                                                                                            • lstrlenW.KERNEL32(C:\,00000000,C:\,C:\, 4#v,?,C:\Users\user\AppData\Local\Temp\,00405C69,?,76233420,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405F6D
                                                                                                                                                                                                                                            • GetFileAttributesW.KERNEL32(C:\,C:\,C:\,C:\,C:\,C:\,00000000,C:\,C:\, 4#v,?,C:\Users\user\AppData\Local\Temp\,00405C69,?,76233420,C:\Users\user\AppData\Local\Temp\), ref: 00405F7D
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000000.00000002.2413490347.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413437029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413539237.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: CharNext$AttributesFilelstrcpynlstrlen
                                                                                                                                                                                                                                            • String ID: 4#v$C:\$C:\Users\user\AppData\Local\Temp\
                                                                                                                                                                                                                                            • API String ID: 3248276644-1150081906
                                                                                                                                                                                                                                            • Opcode ID: 442e1b1d96b1c23b6c0207761c3788c7dd97485575ed4e88a223653099446a7a
                                                                                                                                                                                                                                            • Instruction ID: e20fb510edeaf32ba19235dad054e15b0ffac27cf679254cac4fdbc394554759
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 442e1b1d96b1c23b6c0207761c3788c7dd97485575ed4e88a223653099446a7a
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: E3F0F426119D6226DB22333A5C05EAF0554CE9276475A023BF895B12C5DB3C8A43D8AE
                                                                                                                                                                                                                                            Function 00405A6E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39COMMON
                                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                                            control_flow_graph 781 405a6e-405ab9 CreateDirectoryW 782 405abb-405abd 781->782 783 405abf-405acc GetLastError 781->783 784 405ae6-405ae8 782->784 783->784 785 405ace-405ae2 SetFileSecurityW 783->785 785->782 786 405ae4 GetLastError 785->786 786->784
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • CreateDirectoryW.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\), ref: 00405AB1
                                                                                                                                                                                                                                            • GetLastError.KERNEL32 ref: 00405AC5
                                                                                                                                                                                                                                            • SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 00405ADA
                                                                                                                                                                                                                                            • GetLastError.KERNEL32 ref: 00405AE4
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            • C:\Users\user\AppData\Local\Temp\, xrefs: 00405A94
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000000.00000002.2413490347.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413437029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413539237.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: ErrorLast$CreateDirectoryFileSecurity
                                                                                                                                                                                                                                            • String ID: C:\Users\user\AppData\Local\Temp\
                                                                                                                                                                                                                                            • API String ID: 3449924974-3936084776
                                                                                                                                                                                                                                            • Opcode ID: 79915fdb32ce531948ad707932686e2b3240d3ac97543659e1c0f9af800e449c
                                                                                                                                                                                                                                            • Instruction ID: 637b0a295f6611997b04f2fb2f8121e2d74ae93851c1d74b8ff7b710bfe1865b
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 79915fdb32ce531948ad707932686e2b3240d3ac97543659e1c0f9af800e449c
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 1A010871D04219EAEF019BA0DD84BEFBBB4EB14314F00813AD545B6281E7789648CFE9
                                                                                                                                                                                                                                            Function 00401D81 Relevance: 7.6, APIs: 5, Instructions: 75windowCOMMON
                                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                                            control_flow_graph 787 401d81-401d85 788 401d94-401d9a GetDlgItem 787->788 789 401d87-401d92 call 402d84 787->789 790 401da0-401dcc 788->790 789->790 793 401dd7 790->793 794 401dce-401dd5 call 402da6 790->794 796 401ddb-401e31 GetClientRect LoadImageW SendMessageW 793->796 794->796 798 401e33-401e36 796->798 799 401e3f-401e42 796->799 798->799 800 401e38-401e39 DeleteObject 798->800 801 401e48 799->801 802 402c2a-402c39 799->802 800->799 801->802
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • GetDlgItem.USER32(?,?), ref: 00401D9A
                                                                                                                                                                                                                                            • GetClientRect.USER32(?,?), ref: 00401DE5
                                                                                                                                                                                                                                            • LoadImageW.USER32(?,?,?,?,?,?), ref: 00401E15
                                                                                                                                                                                                                                            • SendMessageW.USER32(?,00000172,?,00000000), ref: 00401E29
                                                                                                                                                                                                                                            • DeleteObject.GDI32(00000000), ref: 00401E39
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000000.00000002.2413490347.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413437029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413539237.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: ClientDeleteImageItemLoadMessageObjectRectSend
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 1849352358-0
                                                                                                                                                                                                                                            • Opcode ID: 0d14a93a4aa2f7ddc0f91d11ffebc05af74b5a93feb44974f4da7284e64bbe2b
                                                                                                                                                                                                                                            • Instruction ID: b69f8f45c5cbb28dd5603d9b1d667d2ce3d3910c133b75fee4ecc707c572ca23
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 0d14a93a4aa2f7ddc0f91d11ffebc05af74b5a93feb44974f4da7284e64bbe2b
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 3321F672904119AFCB05DBA4DE45AEEBBB5EF08314F14003AFA45F62A0DB389951DB98
                                                                                                                                                                                                                                            Function 00401C43 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401CB3
                                                                                                                                                                                                                                            • SendMessageW.USER32(00000000,00000000,?,?), ref: 00401CCB
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000000.00000002.2413490347.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413437029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413539237.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: MessageSend$Timeout
                                                                                                                                                                                                                                            • String ID: !
                                                                                                                                                                                                                                            • API String ID: 1777923405-2657877971
                                                                                                                                                                                                                                            • Opcode ID: 56378305e9cef062e59ac21505f1e4874eb63478d5e018d68d94a8de4df44513
                                                                                                                                                                                                                                            • Instruction ID: 549e056fbb7746b1afa8e7352ee9f1cbf83a3633853e14f9ff1f16dc1dd81c22
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 56378305e9cef062e59ac21505f1e4874eb63478d5e018d68d94a8de4df44513
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 46219C7190420AAFEF05AFA4D94AAAE7BB4FF84304F14453EF601B61D0D7B88941CB98
                                                                                                                                                                                                                                            Function 0040248A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64registrystringCOMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\nsw9A21.tmp,00000023,00000011,00000002), ref: 004024D5
                                                                                                                                                                                                                                            • RegSetValueExW.KERNEL32(?,?,?,?,C:\Users\user\AppData\Local\Temp\nsw9A21.tmp,00000000,00000011,00000002), ref: 00402515
                                                                                                                                                                                                                                            • RegCloseKey.KERNEL32(?,?,?,C:\Users\user\AppData\Local\Temp\nsw9A21.tmp,00000000,00000011,00000002), ref: 004025FD
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000000.00000002.2413490347.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413437029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413539237.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: CloseValuelstrlen
                                                                                                                                                                                                                                            • String ID: C:\Users\user\AppData\Local\Temp\nsw9A21.tmp
                                                                                                                                                                                                                                            • API String ID: 2655323295-1687018659
                                                                                                                                                                                                                                            • Opcode ID: 3f2741e17913f4b3ae47e715a678bc9f1b76d5c80f35dbb4c6e867a5b8f0e772
                                                                                                                                                                                                                                            • Instruction ID: a32c4fc66ba480c3aafb49ec1434dbeb720bd0d2787204a1d049ba7b64bbfaa1
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 3f2741e17913f4b3ae47e715a678bc9f1b76d5c80f35dbb4c6e867a5b8f0e772
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 8B118E71E00119BEEF10AFA5DE49EAEBAB8FF44358F15443AF504F61C1D7B88D40AA58
                                                                                                                                                                                                                                            Function 0040605C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • GetTickCount.KERNEL32 ref: 0040607A
                                                                                                                                                                                                                                            • GetTempFileNameW.KERNEL32(?,?,00000000,?,?,?,?,0040352B,1033,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403810), ref: 00406095
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000000.00000002.2413490347.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413437029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413539237.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: CountFileNameTempTick
                                                                                                                                                                                                                                            • String ID: C:\Users\user\AppData\Local\Temp\$nsa
                                                                                                                                                                                                                                            • API String ID: 1716503409-1857211195
                                                                                                                                                                                                                                            • Opcode ID: 418a87fb760587bef7583f4f3acae06d17b3011fc99645d3e11ea5bfcaa5fca8
                                                                                                                                                                                                                                            • Instruction ID: cc98cbd97bba9fac9576f26979179aa346a2ab2dc3c85b14509754d74f2b81c3
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 418a87fb760587bef7583f4f3acae06d17b3011fc99645d3e11ea5bfcaa5fca8
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: CEF09076B40204FBEB00CF69ED05E9EB7BCEB95750F11803AFA05F7140E6B499648768
                                                                                                                                                                                                                                            Function 00403B57 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • FreeLibrary.KERNEL32(?,76233420,00000000,C:\Users\user\AppData\Local\Temp\,00403B2F,00403A5E,?), ref: 00403B71
                                                                                                                                                                                                                                            • GlobalFree.KERNEL32(?), ref: 00403B78
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            • C:\Users\user\AppData\Local\Temp\, xrefs: 00403B57
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000000.00000002.2413490347.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413437029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413539237.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Free$GlobalLibrary
                                                                                                                                                                                                                                            • String ID: C:\Users\user\AppData\Local\Temp\
                                                                                                                                                                                                                                            • API String ID: 1100898210-3936084776
                                                                                                                                                                                                                                            • Opcode ID: 14d9b0f9b7ecca22f0083886da8930ddd6c03ed0d6fdc94ff3a28603f1b7b4ab
                                                                                                                                                                                                                                            • Instruction ID: 19c5699a9bb8b3376c06320bd1355d3f7d45777e2bc9a3354ca833756e7661a4
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 14d9b0f9b7ecca22f0083886da8930ddd6c03ed0d6fdc94ff3a28603f1b7b4ab
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 40E0EC3290212097C7615F55FE08B6E7B78AF49B26F05056AE884BB2628B746D428BDC
                                                                                                                                                                                                                                            Function 004020D8 Relevance: 4.6, APIs: 3, Instructions: 73libraryCOMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • GetModuleHandleW.KERNEL32(00000000,00000001,000000F0), ref: 00402103
                                                                                                                                                                                                                                              • Part of subcall function 0040559F: lstrlenW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsw9A21.tmp\,00000000,00424420,762323A0,?,?,?,?,?,?,?,?,?,00403418,00000000,?), ref: 004055D7
                                                                                                                                                                                                                                              • Part of subcall function 0040559F: lstrlenW.KERNEL32(00403418,Remove folder: C:\Users\user\AppData\Local\Temp\nsw9A21.tmp\,00000000,00424420,762323A0,?,?,?,?,?,?,?,?,?,00403418,00000000), ref: 004055E7
                                                                                                                                                                                                                                              • Part of subcall function 0040559F: lstrcatW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsw9A21.tmp\,00403418,00403418,Remove folder: C:\Users\user\AppData\Local\Temp\nsw9A21.tmp\,00000000,00424420,762323A0), ref: 004055FA
                                                                                                                                                                                                                                              • Part of subcall function 0040559F: SetWindowTextW.USER32(Remove folder: C:\Users\user\AppData\Local\Temp\nsw9A21.tmp\,Remove folder: C:\Users\user\AppData\Local\Temp\nsw9A21.tmp\), ref: 0040560C
                                                                                                                                                                                                                                              • Part of subcall function 0040559F: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405632
                                                                                                                                                                                                                                              • Part of subcall function 0040559F: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040564C
                                                                                                                                                                                                                                              • Part of subcall function 0040559F: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040565A
                                                                                                                                                                                                                                            • LoadLibraryExW.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 00402114
                                                                                                                                                                                                                                            • FreeLibrary.KERNEL32(?,?,000000F7,?,?,00000008,00000001,000000F0), ref: 00402191
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000000.00000002.2413490347.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413437029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413539237.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: MessageSend$Librarylstrlen$FreeHandleLoadModuleTextWindowlstrcat
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 334405425-0
                                                                                                                                                                                                                                            • Opcode ID: 0bf0e5e813b2564cc7cfb612efcde4c797e71ce7d2922b3564d4c07743ad1514
                                                                                                                                                                                                                                            • Instruction ID: d1cf9917c249e547a3b1759614bc69e8b445b1996c4dbd71fd6f6dd46acd7470
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 0bf0e5e813b2564cc7cfb612efcde4c797e71ce7d2922b3564d4c07743ad1514
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 2A21C231904104FACF11AFA5CE48A9D7A71BF48358F20413BF605B91E1DBBD8A82965D
                                                                                                                                                                                                                                            Function 00401B9B Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 72memoryCOMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • GlobalFree.KERNELBASE(02AC7B48), ref: 00401C0B
                                                                                                                                                                                                                                            • GlobalAlloc.KERNEL32(00000040,00000804), ref: 00401C1D
                                                                                                                                                                                                                                              • Part of subcall function 0040657A: lstrcatW.KERNEL32(Remove folder: ,\Microsoft\Internet Explorer\Quick Launch), ref: 0040671F
                                                                                                                                                                                                                                              • Part of subcall function 0040657A: lstrlenW.KERNEL32(Remove folder: ,00000000,Remove folder: C:\Users\user\AppData\Local\Temp\nsw9A21.tmp\,?,004055D6,Remove folder: C:\Users\user\AppData\Local\Temp\nsw9A21.tmp\,00000000), ref: 00406779
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000000.00000002.2413490347.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413437029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413539237.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Global$AllocFreelstrcatlstrlen
                                                                                                                                                                                                                                            • String ID: get
                                                                                                                                                                                                                                            • API String ID: 3292104215-4248514160
                                                                                                                                                                                                                                            • Opcode ID: f7499587b74b1f9cb3fce9f730428132cfcdd1475af0708a05741156e8f6fa82
                                                                                                                                                                                                                                            • Instruction ID: 7c0f58a685d1fc6dd3685da305ee1819882fb4420ac17dc2787245939102450a
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: f7499587b74b1f9cb3fce9f730428132cfcdd1475af0708a05741156e8f6fa82
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 1B21D872904210EBDB20AFA8EE84A5E73B4EB04715755063BF552F72D0D7B8AC414B9D
                                                                                                                                                                                                                                            Function 0040259E Relevance: 4.5, APIs: 3, Instructions: 47registryCOMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • RegEnumKeyW.ADVAPI32(00000000,00000000,?,000003FF), ref: 004025D1
                                                                                                                                                                                                                                            • RegEnumValueW.ADVAPI32(00000000,00000000,?,?), ref: 004025E4
                                                                                                                                                                                                                                            • RegCloseKey.KERNEL32(?,?,?,C:\Users\user\AppData\Local\Temp\nsw9A21.tmp,00000000,00000011,00000002), ref: 004025FD
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000000.00000002.2413490347.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413437029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413539237.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Enum$CloseValue
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 397863658-0
                                                                                                                                                                                                                                            • Opcode ID: 89c6ceebaf26a2410158c75cc71a1e3b778611476644ea09d24f59567d4f9c93
                                                                                                                                                                                                                                            • Instruction ID: 08080f496e1fbaad801da7c4a2f11cdf7a22a5a493a276a89d416976773fa01e
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 89c6ceebaf26a2410158c75cc71a1e3b778611476644ea09d24f59567d4f9c93
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 89017CB1A04105ABEB159F94DE58AAEB66CEF40348F10403AF501B61C0EBB85E44966D
                                                                                                                                                                                                                                            Function 00405C01 Relevance: 4.5, APIs: 3, Instructions: 28fileCOMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                              • Part of subcall function 00406008: GetFileAttributesW.KERNEL32(?,?,00405C0D,?,?,00000000,00405DE3,?,?,?,?), ref: 0040600D
                                                                                                                                                                                                                                              • Part of subcall function 00406008: SetFileAttributesW.KERNEL32(?,00000000), ref: 00406021
                                                                                                                                                                                                                                            • RemoveDirectoryW.KERNEL32(?,?,?,00000000,00405DE3), ref: 00405C1C
                                                                                                                                                                                                                                            • DeleteFileW.KERNEL32(?,?,?,00000000,00405DE3), ref: 00405C24
                                                                                                                                                                                                                                            • SetFileAttributesW.KERNEL32(?,00000000), ref: 00405C3C
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000000.00000002.2413490347.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413437029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413539237.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: File$Attributes$DeleteDirectoryRemove
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 1655745494-0
                                                                                                                                                                                                                                            • Opcode ID: 8eed124eda4cbc8430ddba83c09443e031bc029d4ce3365f7fb32bc961faff32
                                                                                                                                                                                                                                            • Instruction ID: 0274c5225d47ddc366315f3a2fda4b694ad97aa72442a0e2fcdbaf00fd257d87
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 8eed124eda4cbc8430ddba83c09443e031bc029d4ce3365f7fb32bc961faff32
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: F4E0E53110CF9156E61457309E08F5F2AD8EF86715F05493EF892B10C0CBB848068E6A
                                                                                                                                                                                                                                            Function 00404472 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9windowCOMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • SendMessageW.USER32(00000408,?,00000000,004040D1), ref: 00404490
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000000.00000002.2413490347.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413437029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413539237.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: MessageSend
                                                                                                                                                                                                                                            • String ID: x
                                                                                                                                                                                                                                            • API String ID: 3850602802-2363233923
                                                                                                                                                                                                                                            • Opcode ID: 6afabcb65d7cd0472edcecb82606307073186cf957424f1b3ed57c3b76b5cfb8
                                                                                                                                                                                                                                            • Instruction ID: 1b38e0d23eed931a714c5b599c5829f4d2050063c4158495342b67dc2c27a344
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 6afabcb65d7cd0472edcecb82606307073186cf957424f1b3ed57c3b76b5cfb8
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 10C01271140200EACB004B00DE01F0A7A20B7A0B02F209039F381210B087B05422DB0C
                                                                                                                                                                                                                                            Function 004015C1 Relevance: 3.1, APIs: 2, Instructions: 65COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                              • Part of subcall function 00405EB7: CharNextW.USER32(?,?,C:\,?,00405F2B,C:\,C:\, 4#v,?,C:\Users\user\AppData\Local\Temp\,00405C69,?,76233420,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405EC5
                                                                                                                                                                                                                                              • Part of subcall function 00405EB7: CharNextW.USER32(00000000), ref: 00405ECA
                                                                                                                                                                                                                                              • Part of subcall function 00405EB7: CharNextW.USER32(00000000), ref: 00405EE2
                                                                                                                                                                                                                                            • GetFileAttributesW.KERNEL32(?,?,00000000,0000005C,00000000,000000F0), ref: 0040161A
                                                                                                                                                                                                                                              • Part of subcall function 00405A6E: CreateDirectoryW.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\), ref: 00405AB1
                                                                                                                                                                                                                                            • SetCurrentDirectoryW.KERNEL32(?,00441000,?,00000000,000000F0), ref: 0040164D
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000000.00000002.2413490347.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413437029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413539237.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: CharNext$Directory$AttributesCreateCurrentFile
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 1892508949-0
                                                                                                                                                                                                                                            • Opcode ID: e89a9e6a3f09ade376d0d4b3fd71c203f5cd3ef8be9bd613e1140dffb9deb40c
                                                                                                                                                                                                                                            • Instruction ID: 910f9ca0e916fbda017ea5bccd1daba2d9720f9cae8b5c5670dceb894c5ef12e
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: e89a9e6a3f09ade376d0d4b3fd71c203f5cd3ef8be9bd613e1140dffb9deb40c
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 3E11D031504110EBCF216FA5CD4099F36A0EF25369B28493BE945B52F1DA3E4A829A8E
                                                                                                                                                                                                                                            Function 0040252A Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • RegQueryValueExW.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,00000033), ref: 0040255B
                                                                                                                                                                                                                                            • RegCloseKey.KERNEL32(?,?,?,C:\Users\user\AppData\Local\Temp\nsw9A21.tmp,00000000,00000011,00000002), ref: 004025FD
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000000.00000002.2413490347.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413437029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413539237.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: CloseQueryValue
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 3356406503-0
                                                                                                                                                                                                                                            • Opcode ID: 3fb0128ec3c0afb48f28764f09fc95c95f98cfbd5e462e7a9813c2ba4e742ed8
                                                                                                                                                                                                                                            • Instruction ID: 3e5dab0bbcc9b7b4348569693e39c51bc0b27c59e8ea0ed6abb05ebc10b9b344
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 3fb0128ec3c0afb48f28764f09fc95c95f98cfbd5e462e7a9813c2ba4e742ed8
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 5F116D71900219EADF14DFA4DA589AE77B4FF04345B20443BE401B62C0E7B88A45EB5D
                                                                                                                                                                                                                                            Function 00401F12 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 54COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                              • Part of subcall function 00405B63: ShellExecuteExW.SHELL32(?), ref: 00405B72
                                                                                                                                                                                                                                              • Part of subcall function 004069B5: WaitForSingleObject.KERNEL32(?,00000064), ref: 004069C6
                                                                                                                                                                                                                                              • Part of subcall function 004069B5: GetExitCodeProcess.KERNEL32(?,?), ref: 004069E8
                                                                                                                                                                                                                                            • CloseHandle.KERNEL32(?,?,?,?,?,?), ref: 00401FEB
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000000.00000002.2413490347.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413437029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413539237.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: CloseCodeExecuteExitHandleObjectProcessShellSingleWait
                                                                                                                                                                                                                                            • String ID: @
                                                                                                                                                                                                                                            • API String ID: 165873841-2766056989
                                                                                                                                                                                                                                            • Opcode ID: e9e6b888b2ac62b7866e10c79cc816c8736e15ae282fdec460a2aeb23ba8a534
                                                                                                                                                                                                                                            • Instruction ID: 706d8f23dd4fc365793d21c3b3cee38f3579e955c6bce5a1691758ef83551cc9
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: e9e6b888b2ac62b7866e10c79cc816c8736e15ae282fdec460a2aeb23ba8a534
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 20115B71E042189ADB50EFB9CA49B8CB6F4BF04304F24447AE405F72C1EBBC89459B18
                                                                                                                                                                                                                                            Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
                                                                                                                                                                                                                                            • SendMessageW.USER32(?,00000402,00000000), ref: 004013F4
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000000.00000002.2413490347.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413437029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413539237.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: MessageSend
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 3850602802-0
                                                                                                                                                                                                                                            • Opcode ID: d8feea9b0bd879c8f8267a4ec85e9a32d700cac98845316580bbb569ce856791
                                                                                                                                                                                                                                            • Instruction ID: f98c5e72cab4da6dd47fcf147c12dc0649e5852bd482257a86ca63d172a8b8d6
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: d8feea9b0bd879c8f8267a4ec85e9a32d700cac98845316580bbb569ce856791
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 0B01F4316202209FE7094B389D05B6A3698E710319F14823FF851F65F1EA78DC029B4C
                                                                                                                                                                                                                                            Function 00401EDE Relevance: 3.0, APIs: 2, Instructions: 25COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • ShowWindow.USER32(00000000,00000000), ref: 00401EFC
                                                                                                                                                                                                                                            • EnableWindow.USER32(00000000,00000000), ref: 00401F07
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000000.00000002.2413490347.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413437029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413539237.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Window$EnableShow
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 1136574915-0
                                                                                                                                                                                                                                            • Opcode ID: 5ade1ed26a80a7dd8760c06c43378076533002221f41e68569be4ee1dd8de31a
                                                                                                                                                                                                                                            • Instruction ID: ff95e9915c8c9942b49c08d49a5710ecdabad47c7be9b03b7ba0a01474a23479
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 5ade1ed26a80a7dd8760c06c43378076533002221f41e68569be4ee1dd8de31a
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: E7E04872908211CFE705EBA4EE495AD77F4EF40325710497FE501F11D1DBB55D00965D
                                                                                                                                                                                                                                            Function 00405B20 Relevance: 3.0, APIs: 2, Instructions: 24processCOMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00430270,00000000,00000000), ref: 00405B49
                                                                                                                                                                                                                                            • CloseHandle.KERNEL32(?), ref: 00405B56
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000000.00000002.2413490347.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413437029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413539237.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: CloseCreateHandleProcess
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 3712363035-0
                                                                                                                                                                                                                                            • Opcode ID: 4cad7792158b69fc064c933527736888f22fedd2346a68a48c9e5725d4d2403f
                                                                                                                                                                                                                                            • Instruction ID: 0547baa0b497a95b6ed0e8f273b1969b1ac2c9598ef2001c301bcde660c6e2d6
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 4cad7792158b69fc064c933527736888f22fedd2346a68a48c9e5725d4d2403f
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 3EE092B4600209BFEB10AB64AE49F7B7AACEB04704F004565BA51E61A1DB78E8158A78
                                                                                                                                                                                                                                            Function 0040690A Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • GetModuleHandleA.KERNEL32(?,00000020,?,0040363D,0000000B), ref: 0040691C
                                                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,?), ref: 00406937
                                                                                                                                                                                                                                              • Part of subcall function 0040689A: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004068B1
                                                                                                                                                                                                                                              • Part of subcall function 0040689A: wsprintfW.USER32 ref: 004068EC
                                                                                                                                                                                                                                              • Part of subcall function 0040689A: LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 00406900
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000000.00000002.2413490347.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413437029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413539237.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 2547128583-0
                                                                                                                                                                                                                                            • Opcode ID: 6f78d3fdf53352f122fdb8e7e1f438bdfac4fae158339a91a146711bf240c1a4
                                                                                                                                                                                                                                            • Instruction ID: 98bdf7d71c6046f852b78b75196177710d0a141037308efd39b2ac7baa162fea
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 6f78d3fdf53352f122fdb8e7e1f438bdfac4fae158339a91a146711bf240c1a4
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 9FE0867390422066D21196745D44D7773A89B99750306443EF946F2090DB38DC31A76E
                                                                                                                                                                                                                                            Function 00402C05 Relevance: 3.0, APIs: 2, Instructions: 21windowCOMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • SendMessageW.USER32(?,0000000B,00000001), ref: 00402C14
                                                                                                                                                                                                                                            • InvalidateRect.USER32(?), ref: 00402C24
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000000.00000002.2413490347.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413437029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413539237.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: InvalidateMessageRectSend
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 909852535-0
                                                                                                                                                                                                                                            • Opcode ID: 0509652848a83ac1d7feddac23dc24ced32f84c0220a85d8a6f2313ae5a63aab
                                                                                                                                                                                                                                            • Instruction ID: 5efb85e177e5feb05262591b5578bbf68be0fc1facb886aaf0ec985341d6bcc2
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 0509652848a83ac1d7feddac23dc24ced32f84c0220a85d8a6f2313ae5a63aab
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: CEE08C72700008FFEB01CBA4EE84DAEB779FB40315B00007AF502A00A0D7300D40DA28
                                                                                                                                                                                                                                            Function 0040602D Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • GetFileAttributesW.KERNEL32(00000003,004030BD,C:\Users\user\Desktop\Setup.exe,80000000,00000003,?,?,?,?,?,0040387D,?), ref: 00406031
                                                                                                                                                                                                                                            • CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000,?,?,?,?,?,0040387D,?), ref: 00406053
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000000.00000002.2413490347.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413437029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413539237.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: File$AttributesCreate
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 415043291-0
                                                                                                                                                                                                                                            • Opcode ID: 080dfadfdaad2818d5b04c51cfada36c475993ea7ffea5996e238fb5a0e3a6c4
                                                                                                                                                                                                                                            • Instruction ID: 1030bc0f2bf25390ef9c6131bda9d6cfedcac9e68b753c15eded60bf4a570351
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 080dfadfdaad2818d5b04c51cfada36c475993ea7ffea5996e238fb5a0e3a6c4
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 5ED09E31254201AFEF098F20DE16F2E7BA2EB94B04F11552CB786941E0DAB15C199B15
                                                                                                                                                                                                                                            Function 00406008 Relevance: 3.0, APIs: 2, Instructions: 13COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • GetFileAttributesW.KERNEL32(?,?,00405C0D,?,?,00000000,00405DE3,?,?,?,?), ref: 0040600D
                                                                                                                                                                                                                                            • SetFileAttributesW.KERNEL32(?,00000000), ref: 00406021
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000000.00000002.2413490347.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413437029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413539237.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: AttributesFile
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 3188754299-0
                                                                                                                                                                                                                                            • Opcode ID: a764032cc0ce64e7f87df91ab84dfb27e8fca44cfd77f22972d2dc2d25b91850
                                                                                                                                                                                                                                            • Instruction ID: c979a2e86073268fb5c10017c0603d576bb262e7e1663e1e1b2ee048d1a5e24b
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: a764032cc0ce64e7f87df91ab84dfb27e8fca44cfd77f22972d2dc2d25b91850
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 34D012725041316FC2102728EF0C89BBF55EF643717014B35F9A5A22F0CB304C638A98
                                                                                                                                                                                                                                            Function 00403B12 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 11COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • CloseHandle.KERNEL32(FFFFFFFF,00403A5E,?), ref: 00403B1D
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            • C:\Users\user\AppData\Local\Temp\nsw9A21.tmp\, xrefs: 00403B31
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000000.00000002.2413490347.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413437029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413539237.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: CloseHandle
                                                                                                                                                                                                                                            • String ID: C:\Users\user\AppData\Local\Temp\nsw9A21.tmp\
                                                                                                                                                                                                                                            • API String ID: 2962429428-4284779996
                                                                                                                                                                                                                                            • Opcode ID: e86ec88962d2cddd060eb64ec5e150871475ae72b9f2b14f7d4b77a190cc5563
                                                                                                                                                                                                                                            • Instruction ID: 74b342ff74dc5917d60848dc34610585f5de2c5243f802b65b47dd8438b48b4d
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: e86ec88962d2cddd060eb64ec5e150871475ae72b9f2b14f7d4b77a190cc5563
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 5EC0123050470056D1646F749E4FE153B64AB4073EB600325B0F9B10F1CB3C5759895D
                                                                                                                                                                                                                                            Function 00405AEB Relevance: 3.0, APIs: 2, Instructions: 9COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • CreateDirectoryW.KERNEL32(?,00000000,00403520,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403810), ref: 00405AF1
                                                                                                                                                                                                                                            • GetLastError.KERNEL32 ref: 00405AFF
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000000.00000002.2413490347.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413437029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413539237.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: CreateDirectoryErrorLast
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 1375471231-0
                                                                                                                                                                                                                                            • Opcode ID: a5afa482e644e9a10fedfab033ae5dbb8931bf23a9e1c5533d9f8c1a63861871
                                                                                                                                                                                                                                            • Instruction ID: 33feed20cbbf131019f18849f7ccc9358209a8d33535326e0157453b6049084a
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: a5afa482e644e9a10fedfab033ae5dbb8931bf23a9e1c5533d9f8c1a63861871
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 1BC04C30204501AED6105B609E48B177AA4DB50741F16843D6146E41E0DA789455EE2D
                                                                                                                                                                                                                                            Function 00402891 Relevance: 1.5, APIs: 1, Instructions: 28COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • SetFilePointer.KERNEL32(00000000,?,00000000,?,?), ref: 004028AF
                                                                                                                                                                                                                                              • Part of subcall function 00406484: wsprintfW.USER32 ref: 00406491
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000000.00000002.2413490347.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413437029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413539237.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: FilePointerwsprintf
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 327478801-0
                                                                                                                                                                                                                                            • Opcode ID: 1a69bed114d0c3cb27e295a60469d00fb85b85c1c8bbaab52ea3f411131a6a45
                                                                                                                                                                                                                                            • Instruction ID: a13d1cf18dcce6f7d85bed0b4e0fde0de6b16079219dfacd376ffc086bc6f252
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 1a69bed114d0c3cb27e295a60469d00fb85b85c1c8bbaab52ea3f411131a6a45
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: D3E09271A04105BFDB01EFA5AE499AEB3B8EF44319B10483BF102F00C1DA794D119B2D
                                                                                                                                                                                                                                            Function 004063D8 Relevance: 1.5, APIs: 1, Instructions: 24registryCOMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • RegCreateKeyExW.KERNEL32(00000000,?,00000000,00000000,00000000,?,00000000,?,00000000,?,?,?,00402E57,00000000,?,?), ref: 00406401
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000000.00000002.2413490347.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413437029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413539237.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Create
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 2289755597-0
                                                                                                                                                                                                                                            • Opcode ID: f0170b29b94a961cdf0cc122a920c286c7e5b726b195fdee8f598fb45efbb6e4
                                                                                                                                                                                                                                            • Instruction ID: ccab944935cfefb85f0e849ce69279fb55db75a3b7fb0960311cd9d36817041a
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: f0170b29b94a961cdf0cc122a920c286c7e5b726b195fdee8f598fb45efbb6e4
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 04E0E6B2010109BFEF095F90DC0AD7B3B1DE704300F01892EFD06D4091E6B5AD306675
                                                                                                                                                                                                                                            Function 004060DF Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,00000000,00000004,00000004,00000000,000000FF,?,00403498,00000000,0041EA20,000000FF,0041EA20,000000FF,000000FF,00000004,00000000), ref: 004060F3
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000000.00000002.2413490347.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413437029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413539237.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: FileWrite
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 3934441357-0
                                                                                                                                                                                                                                            • Opcode ID: 3dec9289c2e50997f5b7f42c7d661c3d3292bfbb80aff78175bf8fde073ef60e
                                                                                                                                                                                                                                            • Instruction ID: d8d859634201a592f38c73999a999f352708a9e59580de02994c407fa40ca669
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 3dec9289c2e50997f5b7f42c7d661c3d3292bfbb80aff78175bf8fde073ef60e
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: FAE08C3220026AABEF109E60DC04AEB3B6CFB00360F014837FA16E7081E270E93087A4
                                                                                                                                                                                                                                            Function 004060B0 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • ReadFile.KERNEL32(00000000,00000000,00000004,00000004,00000000,000000FF,?,004034E2,00000000,00000000,00403306,000000FF,00000004,00000000,00000000,00000000), ref: 004060C4
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000000.00000002.2413490347.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413437029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413539237.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: FileRead
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 2738559852-0
                                                                                                                                                                                                                                            • Opcode ID: 0024165f2f5d2011be9120f41fe866c54f7b8e58de784a1218c53157080e4b8c
                                                                                                                                                                                                                                            • Instruction ID: 1583d2e05e1cff28e3594e7db3f0db2d88eef65457287744bb544c492d9958e5
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 0024165f2f5d2011be9120f41fe866c54f7b8e58de784a1218c53157080e4b8c
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: AEE0EC322502AAABDF10AE65DC04AEB7B6CEB05361F018936FD16E6150E631E92197A4
                                                                                                                                                                                                                                            Function 004063AA Relevance: 1.5, APIs: 1, Instructions: 19registryCOMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • RegOpenKeyExW.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,00406438,?,00000000,?,?,Remove folder: ,?), ref: 004063CE
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000000.00000002.2413490347.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413437029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413539237.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Open
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 71445658-0
                                                                                                                                                                                                                                            • Opcode ID: 759d75b29ffd137612e455953a298f0698f5beae901813cd77d6ec234b014f3e
                                                                                                                                                                                                                                            • Instruction ID: 4361357c0318622cec318f667d88df30c4c29b75262f7bca7234b06b46464da2
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 759d75b29ffd137612e455953a298f0698f5beae901813cd77d6ec234b014f3e
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 83D0123210020EBBDF115F91AD01FAB3B5DAB08310F014426FE06E40A1D775D530A764
                                                                                                                                                                                                                                            Function 00404499 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                              • Part of subcall function 0040657A: lstrcatW.KERNEL32(Remove folder: ,\Microsoft\Internet Explorer\Quick Launch), ref: 0040671F
                                                                                                                                                                                                                                              • Part of subcall function 0040657A: lstrlenW.KERNEL32(Remove folder: ,00000000,Remove folder: C:\Users\user\AppData\Local\Temp\nsw9A21.tmp\,?,004055D6,Remove folder: C:\Users\user\AppData\Local\Temp\nsw9A21.tmp\,00000000), ref: 00406779
                                                                                                                                                                                                                                            • SetDlgItemTextW.USER32(?,?,00000000), ref: 004044B3
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000000.00000002.2413490347.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413437029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413539237.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: ItemTextlstrcatlstrlen
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 281422827-0
                                                                                                                                                                                                                                            • Opcode ID: 686190c6e4e1e5cc0914df72c0c951126eb576f2e70f28df627782bea9933419
                                                                                                                                                                                                                                            • Instruction ID: 6ac98b26730712a62f5b3967fa7f39b4c61dbbfa6ef1674fce18da22a1fc1fc0
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 686190c6e4e1e5cc0914df72c0c951126eb576f2e70f28df627782bea9933419
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: D3C08C35008200BFD641A714EC42F0FB7A8FFA031AF00C42EB05CA10D1C63494208A2A
                                                                                                                                                                                                                                            Function 004044E5 Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • SendMessageW.USER32(00020430,00000000,00000000,00000000), ref: 004044F7
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000000.00000002.2413490347.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413437029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413539237.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: MessageSend
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 3850602802-0
                                                                                                                                                                                                                                            • Opcode ID: b985a0028b3d47d2300e38cb49a9103195f452c5c5dca8052d978926f7780193
                                                                                                                                                                                                                                            • Instruction ID: 729772cd993a62bf3dcd5a53f5ba0c6067f9c4589e443fe2cdcdd0dddf41cb53
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: b985a0028b3d47d2300e38cb49a9103195f452c5c5dca8052d978926f7780193
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 74C04CB1740605BADA108B509D45F0677546750701F188429B641A50E0CA74E410D62C
                                                                                                                                                                                                                                            Function 00405B63 Relevance: 1.5, APIs: 1, Instructions: 6COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • ShellExecuteExW.SHELL32(?), ref: 00405B72
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000000.00000002.2413490347.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413437029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413539237.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: ExecuteShell
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 587946157-0
                                                                                                                                                                                                                                            • Opcode ID: 34af207f7f04f37b2a6a243a8c8041682423b78b35e6f682d2e1a111f695392f
                                                                                                                                                                                                                                            • Instruction ID: 155326c85e208380d9db810c36285a9e1b4200be200639c8195ffcf147e959ee
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 34af207f7f04f37b2a6a243a8c8041682423b78b35e6f682d2e1a111f695392f
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: BEC092B2000200EFE301CF80CB09F067BE8AF54306F028068E185DA060C7788840CB29
                                                                                                                                                                                                                                            Function 004044CE Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • SendMessageW.USER32(00000028,?,00000001,004042F9), ref: 004044DC
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000000.00000002.2413490347.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413437029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413539237.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: MessageSend
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 3850602802-0
                                                                                                                                                                                                                                            • Opcode ID: ea04ea026f55595d688d74c1d87789f1c1942be7a89ca5b988cfd0b6025de892
                                                                                                                                                                                                                                            • Instruction ID: f9270ce27bc2d5d500308faa7c43699bdd9cec228278350af1c7ef3a72e6c056
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: ea04ea026f55595d688d74c1d87789f1c1942be7a89ca5b988cfd0b6025de892
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 4FB01235181A00FBDE514B00DE09F857E62F7E4701F058038F341240F0CBB200A4DB08
                                                                                                                                                                                                                                            Function 004034E5 Relevance: 1.5, APIs: 1, Instructions: 6COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • SetFilePointer.KERNEL32(00000000,00000000,00000000,00403242,?,?,?,?,?,?,0040387D,?), ref: 004034F3
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000000.00000002.2413490347.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413437029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413539237.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: FilePointer
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 973152223-0
                                                                                                                                                                                                                                            • Opcode ID: e1e4f0b9cbde4cef3e4374ef9de0ac4f9a9ec0cef6a377cf2568efe91b529ef4
                                                                                                                                                                                                                                            • Instruction ID: 036c8468b6dd2e012b37e6e875261c5f60c7cf4634656b07e897873a541603b6
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: e1e4f0b9cbde4cef3e4374ef9de0ac4f9a9ec0cef6a377cf2568efe91b529ef4
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 1FB01231140304BFDA214F10DF09F067B21BB94700F20C034B384380F086711435EB0D
                                                                                                                                                                                                                                            Function 004044BB Relevance: 1.5, APIs: 1, Instructions: 4COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • KiUserCallbackDispatcher.NTDLL(?,00404292), ref: 004044C5
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000000.00000002.2413490347.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413437029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413539237.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: CallbackDispatcherUser
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 2492992576-0
                                                                                                                                                                                                                                            • Opcode ID: 88c3b14432b04161d4e03979afc52f71aef4d1a500ec292a4d39f98dda9e77ac
                                                                                                                                                                                                                                            • Instruction ID: 0db23a64e3c973129ccb7351ad80e5cfa0365495cc8a336c35755b545d17f2be
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 88c3b14432b04161d4e03979afc52f71aef4d1a500ec292a4d39f98dda9e77ac
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 74A00275508601DBDE115B51DF09D057B71A7547017414579A18551034C6314461EB5D
                                                                                                                                                                                                                                            Function 00401FA4 Relevance: 1.3, APIs: 1, Instructions: 37COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                              • Part of subcall function 0040559F: lstrlenW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsw9A21.tmp\,00000000,00424420,762323A0,?,?,?,?,?,?,?,?,?,00403418,00000000,?), ref: 004055D7
                                                                                                                                                                                                                                              • Part of subcall function 0040559F: lstrlenW.KERNEL32(00403418,Remove folder: C:\Users\user\AppData\Local\Temp\nsw9A21.tmp\,00000000,00424420,762323A0,?,?,?,?,?,?,?,?,?,00403418,00000000), ref: 004055E7
                                                                                                                                                                                                                                              • Part of subcall function 0040559F: lstrcatW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsw9A21.tmp\,00403418,00403418,Remove folder: C:\Users\user\AppData\Local\Temp\nsw9A21.tmp\,00000000,00424420,762323A0), ref: 004055FA
                                                                                                                                                                                                                                              • Part of subcall function 0040559F: SetWindowTextW.USER32(Remove folder: C:\Users\user\AppData\Local\Temp\nsw9A21.tmp\,Remove folder: C:\Users\user\AppData\Local\Temp\nsw9A21.tmp\), ref: 0040560C
                                                                                                                                                                                                                                              • Part of subcall function 0040559F: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405632
                                                                                                                                                                                                                                              • Part of subcall function 0040559F: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040564C
                                                                                                                                                                                                                                              • Part of subcall function 0040559F: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040565A
                                                                                                                                                                                                                                              • Part of subcall function 00405B20: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00430270,00000000,00000000), ref: 00405B49
                                                                                                                                                                                                                                              • Part of subcall function 00405B20: CloseHandle.KERNEL32(?), ref: 00405B56
                                                                                                                                                                                                                                            • CloseHandle.KERNEL32(?,?,?,?,?,?), ref: 00401FEB
                                                                                                                                                                                                                                              • Part of subcall function 004069B5: WaitForSingleObject.KERNEL32(?,00000064), ref: 004069C6
                                                                                                                                                                                                                                              • Part of subcall function 004069B5: GetExitCodeProcess.KERNEL32(?,?), ref: 004069E8
                                                                                                                                                                                                                                              • Part of subcall function 00406484: wsprintfW.USER32 ref: 00406491
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000000.00000002.2413490347.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413437029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413539237.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: MessageSend$CloseHandleProcesslstrlen$CodeCreateExitObjectSingleTextWaitWindowlstrcatwsprintf
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 2972824698-0
                                                                                                                                                                                                                                            • Opcode ID: 11aaa4362747121357e125e8dbb3e446f77891c3c0f7104508ea78bcc2682684
                                                                                                                                                                                                                                            • Instruction ID: a015d294fcb9cc4e365613bb9e09bf6e78b00889af70ee47f703a6c6056ea9c8
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 11aaa4362747121357e125e8dbb3e446f77891c3c0f7104508ea78bcc2682684
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 2DF09072904112EBCB21BBA59A84EDE76E8DF01318F25403BE102B21D1D77C4E429A6E

                                                                                                                                                                                                                                            Non-executed Functions

                                                                                                                                                                                                                                            Function 0040498A Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 275stringCOMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • GetDlgItem.USER32(?,000003FB), ref: 004049D9
                                                                                                                                                                                                                                            • SetWindowTextW.USER32(00000000,?), ref: 00404A03
                                                                                                                                                                                                                                            • SHBrowseForFolderW.SHELL32(?), ref: 00404AB4
                                                                                                                                                                                                                                            • CoTaskMemFree.OLE32(00000000), ref: 00404ABF
                                                                                                                                                                                                                                            • lstrcmpiW.KERNEL32(Remove folder: ,0042D268,00000000,?,?), ref: 00404AF1
                                                                                                                                                                                                                                            • lstrcatW.KERNEL32(?,Remove folder: ), ref: 00404AFD
                                                                                                                                                                                                                                            • SetDlgItemTextW.USER32(?,000003FB,?), ref: 00404B0F
                                                                                                                                                                                                                                              • Part of subcall function 00405B81: GetDlgItemTextW.USER32(?,?,00000400,00404B46), ref: 00405B94
                                                                                                                                                                                                                                              • Part of subcall function 004067C4: CharNextW.USER32(?,*?|<>/":,00000000,00000000,76233420,C:\Users\user\AppData\Local\Temp\,?,00403508,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403810), ref: 00406827
                                                                                                                                                                                                                                              • Part of subcall function 004067C4: CharNextW.USER32(?,?,?,00000000,?,00403508,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403810), ref: 00406836
                                                                                                                                                                                                                                              • Part of subcall function 004067C4: CharNextW.USER32(?,00000000,76233420,C:\Users\user\AppData\Local\Temp\,?,00403508,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403810), ref: 0040683B
                                                                                                                                                                                                                                              • Part of subcall function 004067C4: CharPrevW.USER32(?,?,76233420,C:\Users\user\AppData\Local\Temp\,?,00403508,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403810), ref: 0040684E
                                                                                                                                                                                                                                            • GetDiskFreeSpaceW.KERNEL32(0042B238,?,?,0000040F,?,0042B238,0042B238,?,00000001,0042B238,?,?,000003FB,?), ref: 00404BD2
                                                                                                                                                                                                                                            • MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404BED
                                                                                                                                                                                                                                              • Part of subcall function 00404D46: lstrlenW.KERNEL32(0042D268,0042D268,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404DE7
                                                                                                                                                                                                                                              • Part of subcall function 00404D46: wsprintfW.USER32 ref: 00404DF0
                                                                                                                                                                                                                                              • Part of subcall function 00404D46: SetDlgItemTextW.USER32(?,0042D268), ref: 00404E03
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000000.00000002.2413490347.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413437029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413539237.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
                                                                                                                                                                                                                                            • String ID: A$C:\Users\user\AppData\Local\Temp\nswC086.tmp$Remove folder: $ep
                                                                                                                                                                                                                                            • API String ID: 2624150263-2261631735
                                                                                                                                                                                                                                            • Opcode ID: aac53df244383e2a07a9d2c6e377dc106276e891bc31ab3524a37a2d2ad96109
                                                                                                                                                                                                                                            • Instruction ID: a81e8b8b6ddc8ea4f7a7a45a10ce21cc850824e22f7b82fba9ad49fead82d7d1
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: aac53df244383e2a07a9d2c6e377dc106276e891bc31ab3524a37a2d2ad96109
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: CBA191B1900208ABDB119FA6DD45AAFB7B8EF84314F10803BF601B62D1D77C9A41CB6D
                                                                                                                                                                                                                                            Function 004021AA Relevance: 1.6, APIs: 1, Instructions: 129comCOMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • CoCreateInstance.OLE32(004085F0,?,00000001,004085E0,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402229
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000000.00000002.2413490347.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413437029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413539237.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: CreateInstance
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 542301482-0
                                                                                                                                                                                                                                            • Opcode ID: f0c7f0c58da5b2556a219b4126ec8a5e6c03aa9de5f34d462473648d541e39b0
                                                                                                                                                                                                                                            • Instruction ID: 5977cb51530078b600b156af0050786de557c4b464dd586e6a5beaa7a0440451
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: f0c7f0c58da5b2556a219b4126ec8a5e6c03aa9de5f34d462473648d541e39b0
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: A7411571A00208EFCF40DFE4C989E9D7BB5BF49348B20456AF905EB2D1DB799981CB94
                                                                                                                                                                                                                                            Function 0040290B Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • FindFirstFileW.KERNEL32(00000000,?,00000002), ref: 0040291A
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000000.00000002.2413490347.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413437029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413539237.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: FileFindFirst
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 1974802433-0
                                                                                                                                                                                                                                            • Opcode ID: 23bc45f7dafbc09bf3d58dfb9668e04a20f74da7ffae18e0ad0b6f577034eb1d
                                                                                                                                                                                                                                            • Instruction ID: 3f6fbcf0fd4d311cdd608d5f72697756ed96b8559223cd5d9f1c4d92bc61f1b3
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 23bc45f7dafbc09bf3d58dfb9668e04a20f74da7ffae18e0ad0b6f577034eb1d
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 3CF08271A04105EFD701DBA4ED49AAEB378FF14314F60417BE116F21D0E7B88E159B29
                                                                                                                                                                                                                                            Function 00406D85 Relevance: .3, Instructions: 334COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000000.00000002.2413490347.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413437029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413539237.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                                                            • Opcode ID: fbe53aaae7eeab696340878b5eee03eb0fd33fb80e94407ce6853ed186f7d00c
                                                                                                                                                                                                                                            • Instruction ID: 3db1d01f4341fbbb805040525b4c18df43ce82c239752998d09602440244d977
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: fbe53aaae7eeab696340878b5eee03eb0fd33fb80e94407ce6853ed186f7d00c
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: FEE18A71A0070ADFCB24CF59D880BAABBF5FB44305F15852EE496A72D1D338AA91CF45
                                                                                                                                                                                                                                            Function 0040755C Relevance: .3, Instructions: 300COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000000.00000002.2413490347.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413437029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413539237.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                                                            • Opcode ID: ad3a06017d63110f505e6ee1591874ec5e375aadb040ddd80f083a0c788ff2d1
                                                                                                                                                                                                                                            • Instruction ID: 4d3fc1c80ea15bf86cc2801d6424e98614acddb7a54358772128df9d71e60e61
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: ad3a06017d63110f505e6ee1591874ec5e375aadb040ddd80f083a0c788ff2d1
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: C6C14871E042599BCF18CF68C8905EEBBB2BF88314F25866AD85677380D7347941CF95
                                                                                                                                                                                                                                            Function 00404F06 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 489windowmemoryCOMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • GetDlgItem.USER32(?,000003F9), ref: 00404F1E
                                                                                                                                                                                                                                            • GetDlgItem.USER32(?,00000408), ref: 00404F29
                                                                                                                                                                                                                                            • GlobalAlloc.KERNEL32(00000040,?), ref: 00404F73
                                                                                                                                                                                                                                            • LoadImageW.USER32(0000006E,00000000,00000000,00000000,00000000), ref: 00404F8A
                                                                                                                                                                                                                                            • SetWindowLongW.USER32(?,000000FC,00405513), ref: 00404FA3
                                                                                                                                                                                                                                            • ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404FB7
                                                                                                                                                                                                                                            • ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404FC9
                                                                                                                                                                                                                                            • SendMessageW.USER32(?,00001109,00000002), ref: 00404FDF
                                                                                                                                                                                                                                            • SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404FEB
                                                                                                                                                                                                                                            • SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404FFD
                                                                                                                                                                                                                                            • DeleteObject.GDI32(00000000), ref: 00405000
                                                                                                                                                                                                                                            • SendMessageW.USER32(?,00000143,00000000,00000000), ref: 0040502B
                                                                                                                                                                                                                                            • SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00405037
                                                                                                                                                                                                                                            • SendMessageW.USER32(?,00001132,00000000,?), ref: 004050D2
                                                                                                                                                                                                                                            • SendMessageW.USER32(?,0000110A,00000003,00000110), ref: 00405102
                                                                                                                                                                                                                                              • Part of subcall function 004044CE: SendMessageW.USER32(00000028,?,00000001,004042F9), ref: 004044DC
                                                                                                                                                                                                                                            • SendMessageW.USER32(?,00001132,00000000,?), ref: 00405116
                                                                                                                                                                                                                                            • GetWindowLongW.USER32(?,000000F0), ref: 00405144
                                                                                                                                                                                                                                            • SetWindowLongW.USER32(?,000000F0,00000000), ref: 00405152
                                                                                                                                                                                                                                            • ShowWindow.USER32(?,00000005), ref: 00405162
                                                                                                                                                                                                                                            • SendMessageW.USER32(?,00000419,00000000,?), ref: 0040525D
                                                                                                                                                                                                                                            • SendMessageW.USER32(?,00000147,00000000,00000000), ref: 004052C2
                                                                                                                                                                                                                                            • SendMessageW.USER32(?,00000150,00000000,00000000), ref: 004052D7
                                                                                                                                                                                                                                            • SendMessageW.USER32(?,00000420,00000000,00000020), ref: 004052FB
                                                                                                                                                                                                                                            • SendMessageW.USER32(?,00000200,00000000,00000000), ref: 0040531B
                                                                                                                                                                                                                                            • ImageList_Destroy.COMCTL32(?), ref: 00405330
                                                                                                                                                                                                                                            • GlobalFree.KERNEL32(?), ref: 00405340
                                                                                                                                                                                                                                            • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 004053B9
                                                                                                                                                                                                                                            • SendMessageW.USER32(?,00001102,?,?), ref: 00405462
                                                                                                                                                                                                                                            • SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00405471
                                                                                                                                                                                                                                            • InvalidateRect.USER32(?,00000000,00000001), ref: 0040549C
                                                                                                                                                                                                                                            • ShowWindow.USER32(?,00000000), ref: 004054EA
                                                                                                                                                                                                                                            • GetDlgItem.USER32(?,000003FE), ref: 004054F5
                                                                                                                                                                                                                                            • ShowWindow.USER32(00000000), ref: 004054FC
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000000.00000002.2413490347.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413437029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413539237.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: MessageSend$Window$Image$ItemList_LongShow$Global$AllocCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
                                                                                                                                                                                                                                            • String ID: $M$N
                                                                                                                                                                                                                                            • API String ID: 2564846305-813528018
                                                                                                                                                                                                                                            • Opcode ID: dd942b7cbeaa18c8cf4828e28d43e61687b6a80dcb186ef465745c56d9013c5d
                                                                                                                                                                                                                                            • Instruction ID: 669472b6e39b4296dbb294a81ed98d86f32f22d8abeb4cff7518c6a892085abf
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: dd942b7cbeaa18c8cf4828e28d43e61687b6a80dcb186ef465745c56d9013c5d
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: EF028A70900608EFDB20DFA9DD45AAF7BB5FB84314F10817AE610BA2E0D7799942DF58
                                                                                                                                                                                                                                            Function 00404658 Relevance: 38.7, APIs: 19, Strings: 3, Instructions: 204windowstringCOMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • CheckDlgButton.USER32(?,-0000040A,00000001), ref: 004046F6
                                                                                                                                                                                                                                            • GetDlgItem.USER32(?,000003E8), ref: 0040470A
                                                                                                                                                                                                                                            • SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 00404727
                                                                                                                                                                                                                                            • GetSysColor.USER32(?), ref: 00404738
                                                                                                                                                                                                                                            • SendMessageW.USER32(00000000,00000443,00000000,?), ref: 00404746
                                                                                                                                                                                                                                            • SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 00404754
                                                                                                                                                                                                                                            • lstrlenW.KERNEL32(?), ref: 00404759
                                                                                                                                                                                                                                            • SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 00404766
                                                                                                                                                                                                                                            • SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 0040477B
                                                                                                                                                                                                                                            • GetDlgItem.USER32(?,0000040A), ref: 004047D4
                                                                                                                                                                                                                                            • SendMessageW.USER32(00000000), ref: 004047DB
                                                                                                                                                                                                                                            • GetDlgItem.USER32(?,000003E8), ref: 00404806
                                                                                                                                                                                                                                            • SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 00404849
                                                                                                                                                                                                                                            • LoadCursorW.USER32(00000000,00007F02), ref: 00404857
                                                                                                                                                                                                                                            • SetCursor.USER32(00000000), ref: 0040485A
                                                                                                                                                                                                                                            • LoadCursorW.USER32(00000000,00007F00), ref: 00404873
                                                                                                                                                                                                                                            • SetCursor.USER32(00000000), ref: 00404876
                                                                                                                                                                                                                                            • SendMessageW.USER32(00000111,00000001,00000000), ref: 004048A5
                                                                                                                                                                                                                                            • SendMessageW.USER32(00000010,00000000,00000000), ref: 004048B7
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000000.00000002.2413490347.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413437029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413539237.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
                                                                                                                                                                                                                                            • String ID: N$Remove folder: $ep
                                                                                                                                                                                                                                            • API String ID: 3103080414-6657328
                                                                                                                                                                                                                                            • Opcode ID: ce357ac6e0fd4f2b4f67e04795876aef6a46bd5fea1783cb4cf669a44dc9f0f8
                                                                                                                                                                                                                                            • Instruction ID: e0aa441e67ff77812dea5cfa76c138b5706349c0d06c8e95e02877fce1cb63d1
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: ce357ac6e0fd4f2b4f67e04795876aef6a46bd5fea1783cb4cf669a44dc9f0f8
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 1A61A3B5900209BFDB10AF60DD85E6A7BA9FB44314F00843AFB05B62D0D778A951DF98
                                                                                                                                                                                                                                            Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
                                                                                                                                                                                                                                            • BeginPaint.USER32(?,?), ref: 00401047
                                                                                                                                                                                                                                            • GetClientRect.USER32(?,?), ref: 0040105B
                                                                                                                                                                                                                                            • CreateBrushIndirect.GDI32(00000000), ref: 004010CF
                                                                                                                                                                                                                                            • FillRect.USER32(00000000,?,00000000), ref: 004010E4
                                                                                                                                                                                                                                            • DeleteObject.GDI32(?), ref: 004010ED
                                                                                                                                                                                                                                            • CreateFontIndirectW.GDI32(?), ref: 00401105
                                                                                                                                                                                                                                            • SetBkMode.GDI32(00000000,00000001), ref: 00401126
                                                                                                                                                                                                                                            • SetTextColor.GDI32(00000000,000000FF), ref: 00401130
                                                                                                                                                                                                                                            • SelectObject.GDI32(00000000,?), ref: 00401140
                                                                                                                                                                                                                                            • DrawTextW.USER32(00000000,00433F00,000000FF,00000010,00000820), ref: 00401156
                                                                                                                                                                                                                                            • SelectObject.GDI32(00000000,00000000), ref: 00401160
                                                                                                                                                                                                                                            • DeleteObject.GDI32(?), ref: 00401165
                                                                                                                                                                                                                                            • EndPaint.USER32(?,?), ref: 0040116E
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000000.00000002.2413490347.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413437029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413539237.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
                                                                                                                                                                                                                                            • String ID: F
                                                                                                                                                                                                                                            • API String ID: 941294808-1304234792
                                                                                                                                                                                                                                            • Opcode ID: 15a6b7738402934ac822911e252168026e8f0364f08849f6e110b85e8bc9718e
                                                                                                                                                                                                                                            • Instruction ID: e457e53e67a16f607b198c8be77aa7e47a8fd9e6aa67a1a07366d16d1d2d9a76
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 15a6b7738402934ac822911e252168026e8f0364f08849f6e110b85e8bc9718e
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 0E418B71800209AFCF058FA5DE459AF7FB9FF44315F04802AF991AA1A0C738AA55DFA4
                                                                                                                                                                                                                                            Function 00406183 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 130memorystringCOMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,?,0040631E,?,?), ref: 004061BE
                                                                                                                                                                                                                                            • GetShortPathNameW.KERNEL32(?,00430908,00000400), ref: 004061C7
                                                                                                                                                                                                                                              • Part of subcall function 00405F92: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00406277,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FA2
                                                                                                                                                                                                                                              • Part of subcall function 00405F92: lstrlenA.KERNEL32(00000000,?,00000000,00406277,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FD4
                                                                                                                                                                                                                                            • GetShortPathNameW.KERNEL32(?,00431108,00000400), ref: 004061E4
                                                                                                                                                                                                                                            • wsprintfA.USER32 ref: 00406202
                                                                                                                                                                                                                                            • GetFileSize.KERNEL32(00000000,00000000,00431108,C0000000,00000004,00431108,?,?,?,?,?), ref: 0040623D
                                                                                                                                                                                                                                            • GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 0040624C
                                                                                                                                                                                                                                            • lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00406284
                                                                                                                                                                                                                                            • SetFilePointer.KERNEL32(0040A580,00000000,00000000,00000000,00000000,00430508,00000000,-0000000A,0040A580,00000000,[Rename],00000000,00000000,00000000), ref: 004062DA
                                                                                                                                                                                                                                            • GlobalFree.KERNEL32(00000000), ref: 004062EB
                                                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 004062F2
                                                                                                                                                                                                                                              • Part of subcall function 0040602D: GetFileAttributesW.KERNEL32(00000003,004030BD,C:\Users\user\Desktop\Setup.exe,80000000,00000003,?,?,?,?,?,0040387D,?), ref: 00406031
                                                                                                                                                                                                                                              • Part of subcall function 0040602D: CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000,?,?,?,?,?,0040387D,?), ref: 00406053
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000000.00000002.2413490347.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413437029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413539237.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
                                                                                                                                                                                                                                            • String ID: %ls=%ls$[Rename]
                                                                                                                                                                                                                                            • API String ID: 2171350718-461813615
                                                                                                                                                                                                                                            • Opcode ID: 6dbc896bee28fc2cd17c6beb7c7e3b01e9a95bb407788db3ff507c40593cf796
                                                                                                                                                                                                                                            • Instruction ID: 71978d88b6039f89b25a0dfa2ffa892efa56fbf884cfe692307f7793e751c739
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 6dbc896bee28fc2cd17c6beb7c7e3b01e9a95bb407788db3ff507c40593cf796
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 6A314670200716BBD2207B659D48F6B3A6CEF45754F15017EFA42F62C2EA3CA821867D
                                                                                                                                                                                                                                            Function 00404500 Relevance: 12.1, APIs: 8, Instructions: 68COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • GetWindowLongW.USER32(?,000000EB), ref: 0040451D
                                                                                                                                                                                                                                            • GetSysColor.USER32(00000000), ref: 0040455B
                                                                                                                                                                                                                                            • SetTextColor.GDI32(?,00000000), ref: 00404567
                                                                                                                                                                                                                                            • SetBkMode.GDI32(?,?), ref: 00404573
                                                                                                                                                                                                                                            • GetSysColor.USER32(?), ref: 00404586
                                                                                                                                                                                                                                            • SetBkColor.GDI32(?,?), ref: 00404596
                                                                                                                                                                                                                                            • DeleteObject.GDI32(?), ref: 004045B0
                                                                                                                                                                                                                                            • CreateBrushIndirect.GDI32(?), ref: 004045BA
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000000.00000002.2413490347.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413437029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413539237.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 2320649405-0
                                                                                                                                                                                                                                            • Opcode ID: f4fe220c79686689299554ac50abea47664d32920eac269e7a43003585d3568b
                                                                                                                                                                                                                                            • Instruction ID: 19446832cb8519ea1938040ed984131457e28e93d0b00b9b4dc42373f0e33a15
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: f4fe220c79686689299554ac50abea47664d32920eac269e7a43003585d3568b
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 382177B1500705AFCB31DF68DD08B5BBBF8AF41714B058A2EEA96B22E1C734E944CB54
                                                                                                                                                                                                                                            Function 004067C4 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 69COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • CharNextW.USER32(?,*?|<>/":,00000000,00000000,76233420,C:\Users\user\AppData\Local\Temp\,?,00403508,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403810), ref: 00406827
                                                                                                                                                                                                                                            • CharNextW.USER32(?,?,?,00000000,?,00403508,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403810), ref: 00406836
                                                                                                                                                                                                                                            • CharNextW.USER32(?,00000000,76233420,C:\Users\user\AppData\Local\Temp\,?,00403508,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403810), ref: 0040683B
                                                                                                                                                                                                                                            • CharPrevW.USER32(?,?,76233420,C:\Users\user\AppData\Local\Temp\,?,00403508,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403810), ref: 0040684E
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000000.00000002.2413490347.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413437029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413539237.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Char$Next$Prev
                                                                                                                                                                                                                                            • String ID: *?|<>/":$C:\Users\user\AppData\Local\Temp\
                                                                                                                                                                                                                                            • API String ID: 589700163-826357637
                                                                                                                                                                                                                                            • Opcode ID: 7f8a10c6574f84f045d99a2f2ba91d71661da1c9dbe2055a6f375f6d39957bd5
                                                                                                                                                                                                                                            • Instruction ID: 8e05d213a2b26a47bd0c986db1e6a85e10b5e067f284fb5e9645f7af11a9ce3c
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 7f8a10c6574f84f045d99a2f2ba91d71661da1c9dbe2055a6f375f6d39957bd5
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 7311862780161295DB313B158C44A77A2A8AF58798F56843FED86B32C1E77C8C9282AD
                                                                                                                                                                                                                                            Function 00404E54 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404E6F
                                                                                                                                                                                                                                            • GetMessagePos.USER32 ref: 00404E77
                                                                                                                                                                                                                                            • ScreenToClient.USER32(?,?), ref: 00404E91
                                                                                                                                                                                                                                            • SendMessageW.USER32(?,00001111,00000000,?), ref: 00404EA3
                                                                                                                                                                                                                                            • SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404EC9
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000000.00000002.2413490347.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413437029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413539237.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Message$Send$ClientScreen
                                                                                                                                                                                                                                            • String ID: f
                                                                                                                                                                                                                                            • API String ID: 41195575-1993550816
                                                                                                                                                                                                                                            • Opcode ID: b2affdf3b53bee8738e3b61904ea6c87bda347b462d3853a737802ef9deed65a
                                                                                                                                                                                                                                            • Instruction ID: 177f1d0b32132a6560496663958852c5fe6f1b23f9da62007dee57caca3d7f28
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: b2affdf3b53bee8738e3b61904ea6c87bda347b462d3853a737802ef9deed65a
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 34014C71900219BADB00DBA4DD85BFFBBB8AB54711F10012BBA50B61C0D7B49A058BA5
                                                                                                                                                                                                                                            Function 00401E4E Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • GetDC.USER32(?), ref: 00401E51
                                                                                                                                                                                                                                            • GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401E6B
                                                                                                                                                                                                                                            • MulDiv.KERNEL32(00000000,00000000), ref: 00401E73
                                                                                                                                                                                                                                            • ReleaseDC.USER32(?,00000000), ref: 00401E84
                                                                                                                                                                                                                                              • Part of subcall function 0040657A: lstrcatW.KERNEL32(Remove folder: ,\Microsoft\Internet Explorer\Quick Launch), ref: 0040671F
                                                                                                                                                                                                                                              • Part of subcall function 0040657A: lstrlenW.KERNEL32(Remove folder: ,00000000,Remove folder: C:\Users\user\AppData\Local\Temp\nsw9A21.tmp\,?,004055D6,Remove folder: C:\Users\user\AppData\Local\Temp\nsw9A21.tmp\,00000000), ref: 00406779
                                                                                                                                                                                                                                            • CreateFontIndirectW.GDI32(0040CDF0), ref: 00401ED3
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000000.00000002.2413490347.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413437029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413539237.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: CapsCreateDeviceFontIndirectReleaselstrcatlstrlen
                                                                                                                                                                                                                                            • String ID: MS Shell Dlg
                                                                                                                                                                                                                                            • API String ID: 2584051700-76309092
                                                                                                                                                                                                                                            • Opcode ID: 7613f5a947f4bbf8195753a17fba9eaca46e1d6fc564812dac8d5fa739d0f051
                                                                                                                                                                                                                                            • Instruction ID: 78b13ae86a0973dc2b43aa2eb6c1af0beb3c1ef463c522f55250376beecb9f8a
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 7613f5a947f4bbf8195753a17fba9eaca46e1d6fc564812dac8d5fa739d0f051
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 7001B571904241EFEB005BB0EE49B9A3FB4BB15301F108A39F541B71D2C7B904458BED
                                                                                                                                                                                                                                            Function 00402F93 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402FB1
                                                                                                                                                                                                                                            • MulDiv.KERNEL32(0002BCFB,00000064,0002E668), ref: 00402FDC
                                                                                                                                                                                                                                            • wsprintfW.USER32 ref: 00402FEC
                                                                                                                                                                                                                                            • SetWindowTextW.USER32(?,?), ref: 00402FFC
                                                                                                                                                                                                                                            • SetDlgItemTextW.USER32(?,00000406,?), ref: 0040300E
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            • verifying installer: %d%%, xrefs: 00402FE6
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000000.00000002.2413490347.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413437029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413539237.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Text$ItemTimerWindowwsprintf
                                                                                                                                                                                                                                            • String ID: verifying installer: %d%%
                                                                                                                                                                                                                                            • API String ID: 1451636040-82062127
                                                                                                                                                                                                                                            • Opcode ID: 34baaeb4f482044ab67dd7918236f7f229881b82dd6befd7adca30260b95ec65
                                                                                                                                                                                                                                            • Instruction ID: eb17ebabde20c32bd565f0ca98bf5c3c7f8a04474e671541d9d17dad0456e96b
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 34baaeb4f482044ab67dd7918236f7f229881b82dd6befd7adca30260b95ec65
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 20014B7064020DABEF209F60DE4AFEA3B79FB04345F008039FA06B51D0DBB999559F69
                                                                                                                                                                                                                                            Function 00402950 Relevance: 9.1, APIs: 6, Instructions: 91memoryfileCOMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 004029B1
                                                                                                                                                                                                                                            • GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 004029CD
                                                                                                                                                                                                                                            • GlobalFree.KERNEL32(?), ref: 00402A06
                                                                                                                                                                                                                                            • GlobalFree.KERNEL32(00000000), ref: 00402A19
                                                                                                                                                                                                                                            • CloseHandle.KERNEL32(?,?,?,?,?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 00402A35
                                                                                                                                                                                                                                            • DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 00402A48
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000000.00000002.2413490347.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413437029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413539237.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Global$AllocFree$CloseDeleteFileHandle
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 2667972263-0
                                                                                                                                                                                                                                            • Opcode ID: 18333e3c7c5edca9258600c879c391e4e8cb8a080c4e0dd56f257e0fabcb70bb
                                                                                                                                                                                                                                            • Instruction ID: 8fc1a79e9ee36ebd610a2d663d7387b5f1fea8f48d7bc9e01940cd119f3fb53c
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 18333e3c7c5edca9258600c879c391e4e8cb8a080c4e0dd56f257e0fabcb70bb
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 5831C271D00124BBCF216FA9CE49DDEBE79AF49364F14023AF450762E0CB794C429BA8
                                                                                                                                                                                                                                            Function 00402EA9 Relevance: 7.6, APIs: 5, Instructions: 84registryCOMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • RegEnumValueW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,?,00100020,?,?,?), ref: 00402EFD
                                                                                                                                                                                                                                            • RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402F49
                                                                                                                                                                                                                                            • RegCloseKey.ADVAPI32(?,?,?), ref: 00402F52
                                                                                                                                                                                                                                            • RegDeleteKeyW.ADVAPI32(?,?), ref: 00402F69
                                                                                                                                                                                                                                            • RegCloseKey.ADVAPI32(?,?,?), ref: 00402F74
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000000.00000002.2413490347.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413437029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413539237.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: CloseEnum$DeleteValue
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 1354259210-0
                                                                                                                                                                                                                                            • Opcode ID: 8cb330a57336db5e00a931244e28e0c1e8cbbd051d222c2bd1499622aecedac4
                                                                                                                                                                                                                                            • Instruction ID: ca6229ec891c5908b4c2d3bab14ae3db7b9396451d72a40731f1c02386a45f13
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 8cb330a57336db5e00a931244e28e0c1e8cbbd051d222c2bd1499622aecedac4
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: DA215A7150010ABBEF119F90CE89EEF7B7DEB50384F100076F909B21A0D7B49E54AA68
                                                                                                                                                                                                                                            Function 00404D46 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84stringCOMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • lstrlenW.KERNEL32(0042D268,0042D268,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404DE7
                                                                                                                                                                                                                                            • wsprintfW.USER32 ref: 00404DF0
                                                                                                                                                                                                                                            • SetDlgItemTextW.USER32(?,0042D268), ref: 00404E03
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000000.00000002.2413490347.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413437029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413539237.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: ItemTextlstrlenwsprintf
                                                                                                                                                                                                                                            • String ID: %u.%u%s%s
                                                                                                                                                                                                                                            • API String ID: 3540041739-3551169577
                                                                                                                                                                                                                                            • Opcode ID: f5c410226751388561f0977026f7bc113d9509f0ffdd9d2834ff72966f8c02b6
                                                                                                                                                                                                                                            • Instruction ID: d7f2b51e3f2153b105aad6c1cbcae815e44f670c765de83d30fbb221df5484fa
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: f5c410226751388561f0977026f7bc113d9509f0ffdd9d2834ff72966f8c02b6
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: AC11D573A041283BDB10656DAC45E9E369CAF81334F254237FA66F21D1EA78D91182E8
                                                                                                                                                                                                                                            Function 00405EB7 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • CharNextW.USER32(?,?,C:\,?,00405F2B,C:\,C:\, 4#v,?,C:\Users\user\AppData\Local\Temp\,00405C69,?,76233420,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405EC5
                                                                                                                                                                                                                                            • CharNextW.USER32(00000000), ref: 00405ECA
                                                                                                                                                                                                                                            • CharNextW.USER32(00000000), ref: 00405EE2
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000000.00000002.2413490347.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413437029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413539237.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: CharNext
                                                                                                                                                                                                                                            • String ID: C:\
                                                                                                                                                                                                                                            • API String ID: 3213498283-3404278061
                                                                                                                                                                                                                                            • Opcode ID: 389604e099afbb0f1c733809242fd9884b65eb47018f1a61235cb76474637dc7
                                                                                                                                                                                                                                            • Instruction ID: b7f7aa27055ddc775a1b47344aef2f77b81fec2ea34db2f3ccdabfa21b6bce3d
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 389604e099afbb0f1c733809242fd9884b65eb47018f1a61235cb76474637dc7
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 7BF0F631810E1296DB317B548C44E7B97BCEB64354B04843BD741B71C0D3BC8D808BDA
                                                                                                                                                                                                                                            Function 00405E0C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • lstrlenW.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,0040351A,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403810), ref: 00405E12
                                                                                                                                                                                                                                            • CharPrevW.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,0040351A,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403810), ref: 00405E1C
                                                                                                                                                                                                                                            • lstrcatW.KERNEL32(?,0040A014), ref: 00405E2E
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            • C:\Users\user\AppData\Local\Temp\, xrefs: 00405E0C
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000000.00000002.2413490347.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413437029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413539237.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: CharPrevlstrcatlstrlen
                                                                                                                                                                                                                                            • String ID: C:\Users\user\AppData\Local\Temp\
                                                                                                                                                                                                                                            • API String ID: 2659869361-3936084776
                                                                                                                                                                                                                                            • Opcode ID: 7317fb0b60a0da6156192e69c80d181f5022b3d5f83b8f009beaa75eacd33bdb
                                                                                                                                                                                                                                            • Instruction ID: 1a595bf39a0a3392b99637bd72bd9cca8666c17676e511d5d4bf90e80f698eee
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 7317fb0b60a0da6156192e69c80d181f5022b3d5f83b8f009beaa75eacd33bdb
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: A8D0A731101930BAC2127B49EC08DDF62ACAE89340341443BF145B30A4CB7C5E5187FD
                                                                                                                                                                                                                                            Function 0040263E Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 65stringCOMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsw9A21.tmp\inetc.dll), ref: 00402695
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000000.00000002.2413490347.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413437029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413539237.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: lstrlen
                                                                                                                                                                                                                                            • String ID: C:\Users\user\AppData\Local\Temp\nsw9A21.tmp$C:\Users\user\AppData\Local\Temp\nsw9A21.tmp\inetc.dll
                                                                                                                                                                                                                                            • API String ID: 1659193697-4198719368
                                                                                                                                                                                                                                            • Opcode ID: fbd5ee5e4de60feb08ffa62b35b3018c7a91bb86716aa8782bbd76b946f17d50
                                                                                                                                                                                                                                            • Instruction ID: edf8e5a6553ae7ef136857fb61bcac29e22bbc78049b19fa22ca3c34260198f3
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: fbd5ee5e4de60feb08ffa62b35b3018c7a91bb86716aa8782bbd76b946f17d50
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 2611EB71A00215BBCB10BFB18E4AAAE7665AF40744F25443FE002B71C2EAFC8891565E
                                                                                                                                                                                                                                            Function 00403019 Relevance: 6.0, APIs: 4, Instructions: 33COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • DestroyWindow.USER32(00000000,00000000,004031F7,00000001,?,?,?,?,?,0040387D,?), ref: 0040302C
                                                                                                                                                                                                                                            • GetTickCount.KERNEL32 ref: 0040304A
                                                                                                                                                                                                                                            • CreateDialogParamW.USER32(0000006F,00000000,00402F93,00000000), ref: 00403067
                                                                                                                                                                                                                                            • ShowWindow.USER32(00000000,00000005,?,?,?,?,?,0040387D,?), ref: 00403075
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000000.00000002.2413490347.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413437029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413539237.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Window$CountCreateDestroyDialogParamShowTick
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 2102729457-0
                                                                                                                                                                                                                                            • Opcode ID: a982ea5e0a4ecb993fc2e9b794e4afe077943b4b771bcbca33e5c7758572dd30
                                                                                                                                                                                                                                            • Instruction ID: 3364d2369d767f53e7c05e99e54cbc9c067443d5da9c9f227d7c3a258cba7bb7
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: a982ea5e0a4ecb993fc2e9b794e4afe077943b4b771bcbca33e5c7758572dd30
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: A9F08270702A20AFC2316F50FE4998B7F68FB44B56741447AF446B15ACCB380DA2CB9D
                                                                                                                                                                                                                                            Function 00405513 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • IsWindowVisible.USER32(?), ref: 00405542
                                                                                                                                                                                                                                            • CallWindowProcW.USER32(?,?,?,?), ref: 00405593
                                                                                                                                                                                                                                              • Part of subcall function 004044E5: SendMessageW.USER32(00020430,00000000,00000000,00000000), ref: 004044F7
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000000.00000002.2413490347.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413437029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413539237.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Window$CallMessageProcSendVisible
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 3748168415-3916222277
                                                                                                                                                                                                                                            • Opcode ID: 0dea828d0dd479423763887dac230e90f27d8b8ae518018479b0ad82d517bb95
                                                                                                                                                                                                                                            • Instruction ID: 904a7c61355239921aaa7855b64c86422fca6e8886f64d9e6fcbc6a993ea73ec
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 0dea828d0dd479423763887dac230e90f27d8b8ae518018479b0ad82d517bb95
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: F3017CB1100608BFDF209F11DD80AAB3B27EB84754F50453AFA01762D5D77A8E92DA69
                                                                                                                                                                                                                                            Function 0040640B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44registryCOMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000800,00000000,?,00000000,?,?,Remove folder: ,?,?,00406672,80000002), ref: 00406451
                                                                                                                                                                                                                                            • RegCloseKey.ADVAPI32(?,?,00406672,80000002,Software\Microsoft\Windows\CurrentVersion,Remove folder: ,Remove folder: ,Remove folder: ,00000000,Remove folder: C:\Users\user\AppData\Local\Temp\nsw9A21.tmp\), ref: 0040645C
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000000.00000002.2413490347.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413437029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413539237.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: CloseQueryValue
                                                                                                                                                                                                                                            • String ID: Remove folder:
                                                                                                                                                                                                                                            • API String ID: 3356406503-1958208860
                                                                                                                                                                                                                                            • Opcode ID: a598e195228f1036644e08b1753da052d1713cd74bd9ea8ab147b12b545f69e3
                                                                                                                                                                                                                                            • Instruction ID: a8d415a3dc4e4479eaaa65942f717852bb8bd3539c12dad3b2e52d491ce509ba
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: a598e195228f1036644e08b1753da052d1713cd74bd9ea8ab147b12b545f69e3
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: FB017C72510209AADF21CF51CC09EDB3BB8FB54364F01803AFD5AA6190D738D968DBA8
                                                                                                                                                                                                                                            Function 00405F92 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00406277,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FA2
                                                                                                                                                                                                                                            • lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405FBA
                                                                                                                                                                                                                                            • CharNextA.USER32(00000000,?,00000000,00406277,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FCB
                                                                                                                                                                                                                                            • lstrlenA.KERNEL32(00000000,?,00000000,00406277,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FD4
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000000.00000002.2413490347.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413437029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413539237.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2413568462.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000000.00000002.2416977992.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: lstrlen$CharNextlstrcmpi
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 190613189-0
                                                                                                                                                                                                                                            • Opcode ID: 21d608d80335ac136f0ceeda94a64e737efc7ffd0529c55eb96d3cb5f29812e9
                                                                                                                                                                                                                                            • Instruction ID: bd09551308ad338638525116890fdadd4ab1f465f5503068af61de479685a4e4
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 21d608d80335ac136f0ceeda94a64e737efc7ffd0529c55eb96d3cb5f29812e9
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 34F0C231604418FFC7029BA5CD0099EBBA8EF06250B2140AAF840FB210D678DE019BA9

                                                                                                                                                                                                                                            Execution Graph

                                                                                                                                                                                                                                            Execution Coverage:20.1%
                                                                                                                                                                                                                                            Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                                                                            Signature Coverage:0%
                                                                                                                                                                                                                                            Total number of Nodes:1386
                                                                                                                                                                                                                                            Total number of Limit Nodes:31
                                                                                                                                                                                                                                            execution_graph 3224 403640 SetErrorMode GetVersionExW 3225 403692 GetVersionExW 3224->3225 3226 4036ca 3224->3226 3225->3226 3227 403723 3226->3227 3228 406a35 5 API calls 3226->3228 3314 4069c5 GetSystemDirectoryW 3227->3314 3228->3227 3230 403739 lstrlenA 3230->3227 3231 403749 3230->3231 3317 406a35 GetModuleHandleA 3231->3317 3234 406a35 5 API calls 3235 403757 3234->3235 3236 406a35 5 API calls 3235->3236 3237 403763 #17 OleInitialize SHGetFileInfoW 3236->3237 3323 406668 lstrcpynW 3237->3323 3240 4037b0 GetCommandLineW 3324 406668 lstrcpynW 3240->3324 3242 4037c2 3325 405f64 3242->3325 3245 4038f7 3246 40390b GetTempPathW 3245->3246 3329 40360f 3246->3329 3248 403923 3250 403927 GetWindowsDirectoryW lstrcatW 3248->3250 3251 40397d DeleteFileW 3248->3251 3249 405f64 CharNextW 3253 4037f9 3249->3253 3254 40360f 12 API calls 3250->3254 3339 4030d0 GetTickCount GetModuleFileNameW 3251->3339 3253->3245 3253->3249 3258 4038f9 3253->3258 3256 403943 3254->3256 3255 403990 3259 403b6c ExitProcess CoUninitialize 3255->3259 3261 403a45 3255->3261 3268 405f64 CharNextW 3255->3268 3256->3251 3257 403947 GetTempPathW lstrcatW SetEnvironmentVariableW SetEnvironmentVariableW 3256->3257 3260 40360f 12 API calls 3257->3260 3426 406668 lstrcpynW 3258->3426 3263 403b91 3259->3263 3264 403b7c 3259->3264 3267 403975 3260->3267 3369 403d17 3261->3369 3265 403b99 GetCurrentProcess OpenProcessToken 3263->3265 3266 403c0f ExitProcess 3263->3266 3480 405cc8 3264->3480 3271 403bb0 LookupPrivilegeValueW AdjustTokenPrivileges 3265->3271 3272 403bdf 3265->3272 3267->3251 3267->3259 3283 4039b2 3268->3283 3271->3272 3276 406a35 5 API calls 3272->3276 3273 403a54 3273->3259 3279 403be6 3276->3279 3277 403a1b 3427 40603f 3277->3427 3278 403a5c 3443 405c33 3278->3443 3281 403bfb ExitWindowsEx 3279->3281 3285 403c08 3279->3285 3281->3266 3281->3285 3283->3277 3283->3278 3484 40140b 3285->3484 3288 403a72 lstrcatW 3289 403a7d lstrcatW lstrcmpiW 3288->3289 3289->3273 3290 403a9d 3289->3290 3292 403aa2 3290->3292 3293 403aa9 3290->3293 3446 405b99 CreateDirectoryW 3292->3446 3451 405c16 CreateDirectoryW 3293->3451 3294 403a3a 3442 406668 lstrcpynW 3294->3442 3299 403aae SetCurrentDirectoryW 3300 403ac0 3299->3300 3301 403acb 3299->3301 3454 406668 lstrcpynW 3300->3454 3455 406668 lstrcpynW 3301->3455 3306 403b19 CopyFileW 3310 403ad8 3306->3310 3307 403b63 3309 406428 36 API calls 3307->3309 3309->3273 3310->3307 3311 4066a5 17 API calls 3310->3311 3313 403b4d CloseHandle 3310->3313 3456 4066a5 3310->3456 3473 406428 MoveFileExW 3310->3473 3477 405c4b CreateProcessW 3310->3477 3311->3310 3313->3310 3315 4069e7 wsprintfW LoadLibraryExW 3314->3315 3315->3230 3318 406a51 3317->3318 3319 406a5b GetProcAddress 3317->3319 3320 4069c5 3 API calls 3318->3320 3321 403750 3319->3321 3322 406a57 3320->3322 3321->3234 3322->3319 3322->3321 3323->3240 3324->3242 3326 405f6a 3325->3326 3327 4037e8 CharNextW 3326->3327 3328 405f71 CharNextW 3326->3328 3327->3253 3328->3326 3487 4068ef 3329->3487 3331 403625 3331->3248 3332 40361b 3332->3331 3496 405f37 lstrlenW CharPrevW 3332->3496 3335 405c16 2 API calls 3336 403633 3335->3336 3499 406187 3336->3499 3503 406158 GetFileAttributesW CreateFileW 3339->3503 3341 403113 3368 403120 3341->3368 3504 406668 lstrcpynW 3341->3504 3343 403136 3505 405f83 lstrlenW 3343->3505 3347 403147 GetFileSize 3348 403241 3347->3348 3367 40315e 3347->3367 3510 40302e 3348->3510 3352 403286 GlobalAlloc 3355 40329d 3352->3355 3354 4032de 3356 40302e 32 API calls 3354->3356 3359 406187 2 API calls 3355->3359 3356->3368 3357 403267 3358 4035e2 ReadFile 3357->3358 3360 403272 3358->3360 3362 4032ae CreateFileW 3359->3362 3360->3352 3360->3368 3361 40302e 32 API calls 3361->3367 3363 4032e8 3362->3363 3362->3368 3525 4035f8 SetFilePointer 3363->3525 3365 4032f6 3526 403371 3365->3526 3367->3348 3367->3354 3367->3361 3367->3368 3541 4035e2 3367->3541 3368->3255 3370 406a35 5 API calls 3369->3370 3371 403d2b 3370->3371 3372 403d31 3371->3372 3373 403d43 3371->3373 3596 4065af wsprintfW 3372->3596 3597 406536 3373->3597 3377 403d92 lstrcatW 3378 403d41 3377->3378 3588 403fed 3378->3588 3379 406536 3 API calls 3379->3377 3382 40603f 18 API calls 3383 403dc4 3382->3383 3384 403e58 3383->3384 3386 406536 3 API calls 3383->3386 3385 40603f 18 API calls 3384->3385 3387 403e5e 3385->3387 3393 403df6 3386->3393 3388 403e6e LoadImageW 3387->3388 3389 4066a5 17 API calls 3387->3389 3390 403f14 3388->3390 3391 403e95 RegisterClassW 3388->3391 3389->3388 3395 40140b 2 API calls 3390->3395 3394 403ecb SystemParametersInfoW CreateWindowExW 3391->3394 3424 403f1e 3391->3424 3392 403e17 lstrlenW 3397 403e25 lstrcmpiW 3392->3397 3398 403e4b 3392->3398 3393->3384 3393->3392 3396 405f64 CharNextW 3393->3396 3394->3390 3399 403f1a 3395->3399 3400 403e14 3396->3400 3397->3398 3401 403e35 GetFileAttributesW 3397->3401 3402 405f37 3 API calls 3398->3402 3404 403fed 18 API calls 3399->3404 3399->3424 3400->3392 3403 403e41 3401->3403 3405 403e51 3402->3405 3403->3398 3406 405f83 2 API calls 3403->3406 3407 403f2b 3404->3407 3602 406668 lstrcpynW 3405->3602 3406->3398 3409 403f37 ShowWindow 3407->3409 3410 403fba 3407->3410 3411 4069c5 3 API calls 3409->3411 3603 40579d OleInitialize 3410->3603 3413 403f4f 3411->3413 3415 403f5d GetClassInfoW 3413->3415 3418 4069c5 3 API calls 3413->3418 3414 403fc0 3416 403fc4 3414->3416 3417 403fdc 3414->3417 3420 403f71 GetClassInfoW RegisterClassW 3415->3420 3421 403f87 DialogBoxParamW 3415->3421 3422 40140b 2 API calls 3416->3422 3416->3424 3419 40140b 2 API calls 3417->3419 3418->3415 3419->3424 3420->3421 3423 40140b 2 API calls 3421->3423 3422->3424 3425 403faf 3423->3425 3424->3273 3425->3424 3426->3246 3625 406668 lstrcpynW 3427->3625 3429 406050 3626 405fe2 CharNextW CharNextW 3429->3626 3432 403a27 3432->3259 3441 406668 lstrcpynW 3432->3441 3433 4068ef 5 API calls 3439 406066 3433->3439 3434 406097 lstrlenW 3435 4060a2 3434->3435 3434->3439 3436 405f37 3 API calls 3435->3436 3438 4060a7 GetFileAttributesW 3436->3438 3438->3432 3439->3432 3439->3434 3440 405f83 2 API calls 3439->3440 3632 40699e FindFirstFileW 3439->3632 3440->3434 3441->3294 3442->3261 3444 406a35 5 API calls 3443->3444 3445 403a61 lstrcatW 3444->3445 3445->3288 3445->3289 3447 403aa7 3446->3447 3448 405bea GetLastError 3446->3448 3447->3299 3448->3447 3449 405bf9 SetFileSecurityW 3448->3449 3449->3447 3450 405c0f GetLastError 3449->3450 3450->3447 3452 405c2a GetLastError 3451->3452 3453 405c26 3451->3453 3452->3453 3453->3299 3454->3301 3455->3310 3460 4066b2 3456->3460 3457 4068d5 3458 403b0d DeleteFileW 3457->3458 3637 406668 lstrcpynW 3457->3637 3458->3306 3458->3310 3460->3457 3461 4068a3 lstrlenW 3460->3461 3462 4067ba GetSystemDirectoryW 3460->3462 3465 406536 3 API calls 3460->3465 3466 4066a5 10 API calls 3460->3466 3467 4067cd GetWindowsDirectoryW 3460->3467 3468 406844 lstrcatW 3460->3468 3469 4066a5 10 API calls 3460->3469 3470 4068ef 5 API calls 3460->3470 3471 4067fc SHGetSpecialFolderLocation 3460->3471 3635 4065af wsprintfW 3460->3635 3636 406668 lstrcpynW 3460->3636 3461->3460 3462->3460 3465->3460 3466->3461 3467->3460 3468->3460 3469->3460 3470->3460 3471->3460 3472 406814 SHGetPathFromIDListW CoTaskMemFree 3471->3472 3472->3460 3474 406449 3473->3474 3475 40643c 3473->3475 3474->3310 3638 4062ae 3475->3638 3478 405c8a 3477->3478 3479 405c7e CloseHandle 3477->3479 3478->3310 3479->3478 3483 405cdd 3480->3483 3481 403b89 ExitProcess 3482 405cf1 MessageBoxIndirectW 3482->3481 3483->3481 3483->3482 3485 401389 2 API calls 3484->3485 3486 401420 3485->3486 3486->3266 3488 4068fc 3487->3488 3490 406972 3488->3490 3491 406965 CharNextW 3488->3491 3493 405f64 CharNextW 3488->3493 3494 406951 CharNextW 3488->3494 3495 406960 CharNextW 3488->3495 3489 406977 CharPrevW 3489->3490 3490->3489 3492 406998 3490->3492 3491->3488 3491->3490 3492->3332 3493->3488 3494->3488 3495->3491 3497 405f53 lstrcatW 3496->3497 3498 40362d 3496->3498 3497->3498 3498->3335 3500 406194 GetTickCount GetTempFileNameW 3499->3500 3501 40363e 3500->3501 3502 4061ca 3500->3502 3501->3248 3502->3500 3502->3501 3503->3341 3504->3343 3506 405f91 3505->3506 3507 40313c 3506->3507 3508 405f97 CharPrevW 3506->3508 3509 406668 lstrcpynW 3507->3509 3508->3506 3508->3507 3509->3347 3511 403057 3510->3511 3512 40303f 3510->3512 3514 403067 GetTickCount 3511->3514 3515 40305f 3511->3515 3513 403048 DestroyWindow 3512->3513 3518 40304f 3512->3518 3513->3518 3517 403075 3514->3517 3514->3518 3545 406a71 3515->3545 3519 4030aa CreateDialogParamW ShowWindow 3517->3519 3520 40307d 3517->3520 3518->3352 3518->3368 3544 4035f8 SetFilePointer 3518->3544 3519->3518 3520->3518 3549 403012 3520->3549 3522 40308b wsprintfW 3552 4056ca 3522->3552 3525->3365 3527 403380 SetFilePointer 3526->3527 3528 40339c 3526->3528 3527->3528 3563 403479 GetTickCount 3528->3563 3533 403479 42 API calls 3534 4033d3 3533->3534 3535 40343f ReadFile 3534->3535 3539 4033e2 3534->3539 3540 403439 3534->3540 3535->3540 3537 4061db ReadFile 3537->3539 3539->3537 3539->3540 3578 40620a WriteFile 3539->3578 3540->3368 3542 4061db ReadFile 3541->3542 3543 4035f5 3542->3543 3543->3367 3544->3357 3546 406a8e PeekMessageW 3545->3546 3547 406a84 DispatchMessageW 3546->3547 3548 406a9e 3546->3548 3547->3546 3548->3518 3550 403021 3549->3550 3551 403023 MulDiv 3549->3551 3550->3551 3551->3522 3553 4056e5 3552->3553 3554 4030a8 3552->3554 3555 405701 lstrlenW 3553->3555 3556 4066a5 17 API calls 3553->3556 3554->3518 3557 40572a 3555->3557 3558 40570f lstrlenW 3555->3558 3556->3555 3559 405730 SetWindowTextW 3557->3559 3560 40573d 3557->3560 3558->3554 3561 405721 lstrcatW 3558->3561 3559->3560 3560->3554 3562 405743 SendMessageW SendMessageW SendMessageW 3560->3562 3561->3557 3562->3554 3564 4035d1 3563->3564 3565 4034a7 3563->3565 3566 40302e 32 API calls 3564->3566 3580 4035f8 SetFilePointer 3565->3580 3573 4033a3 3566->3573 3568 4034b2 SetFilePointer 3572 4034d7 3568->3572 3569 4035e2 ReadFile 3569->3572 3571 40302e 32 API calls 3571->3572 3572->3569 3572->3571 3572->3573 3574 40620a WriteFile 3572->3574 3575 4035b2 SetFilePointer 3572->3575 3581 406bb0 3572->3581 3573->3540 3576 4061db ReadFile 3573->3576 3574->3572 3575->3564 3577 4033bc 3576->3577 3577->3533 3577->3540 3579 406228 3578->3579 3579->3539 3580->3568 3582 406bd5 3581->3582 3583 406bdd 3581->3583 3582->3572 3583->3582 3584 406c64 GlobalFree 3583->3584 3585 406c6d GlobalAlloc 3583->3585 3586 406ce4 GlobalAlloc 3583->3586 3587 406cdb GlobalFree 3583->3587 3584->3585 3585->3582 3585->3583 3586->3582 3586->3583 3587->3586 3589 404001 3588->3589 3610 4065af wsprintfW 3589->3610 3591 404072 3611 4040a6 3591->3611 3593 403da2 3593->3382 3594 404077 3594->3593 3595 4066a5 17 API calls 3594->3595 3595->3594 3596->3378 3614 4064d5 3597->3614 3600 403d73 3600->3377 3600->3379 3601 40656a RegQueryValueExW RegCloseKey 3601->3600 3602->3384 3618 404610 3603->3618 3605 4057e7 3606 404610 SendMessageW 3605->3606 3608 4057f9 OleUninitialize 3606->3608 3607 4057c0 3607->3605 3621 401389 3607->3621 3608->3414 3610->3591 3612 4066a5 17 API calls 3611->3612 3613 4040b4 SetWindowTextW 3612->3613 3613->3594 3615 4064e4 3614->3615 3616 4064e8 3615->3616 3617 4064ed RegOpenKeyExW 3615->3617 3616->3600 3616->3601 3617->3616 3619 404628 3618->3619 3620 404619 SendMessageW 3618->3620 3619->3607 3620->3619 3623 401390 3621->3623 3622 4013fe 3622->3607 3623->3622 3624 4013cb MulDiv SendMessageW 3623->3624 3624->3623 3625->3429 3627 405fff 3626->3627 3629 406011 3626->3629 3628 40600c CharNextW 3627->3628 3627->3629 3631 406035 3628->3631 3630 405f64 CharNextW 3629->3630 3629->3631 3630->3629 3631->3432 3631->3433 3633 4069b4 FindClose 3632->3633 3634 4069bf 3632->3634 3633->3634 3634->3439 3635->3460 3636->3460 3637->3458 3639 406304 GetShortPathNameW 3638->3639 3640 4062de 3638->3640 3641 406423 3639->3641 3642 406319 3639->3642 3665 406158 GetFileAttributesW CreateFileW 3640->3665 3641->3474 3642->3641 3644 406321 wsprintfA 3642->3644 3646 4066a5 17 API calls 3644->3646 3645 4062e8 CloseHandle GetShortPathNameW 3645->3641 3647 4062fc 3645->3647 3648 406349 3646->3648 3647->3639 3647->3641 3666 406158 GetFileAttributesW CreateFileW 3648->3666 3650 406356 3650->3641 3651 406365 GetFileSize GlobalAlloc 3650->3651 3652 406387 3651->3652 3653 40641c CloseHandle 3651->3653 3654 4061db ReadFile 3652->3654 3653->3641 3655 40638f 3654->3655 3655->3653 3667 4060bd lstrlenA 3655->3667 3658 4063a6 lstrcpyA 3661 4063c8 3658->3661 3659 4063ba 3660 4060bd 4 API calls 3659->3660 3660->3661 3662 4063ff SetFilePointer 3661->3662 3663 40620a WriteFile 3662->3663 3664 406415 GlobalFree 3663->3664 3664->3653 3665->3645 3666->3650 3668 4060fe lstrlenA 3667->3668 3669 406106 3668->3669 3670 4060d7 lstrcmpiA 3668->3670 3669->3658 3669->3659 3670->3669 3671 4060f5 CharNextA 3670->3671 3671->3668 3672 401941 3673 401943 3672->3673 3678 402da6 3673->3678 3679 402db2 3678->3679 3680 4066a5 17 API calls 3679->3680 3681 402dd3 3680->3681 3682 401948 3681->3682 3683 4068ef 5 API calls 3681->3683 3684 405d74 3682->3684 3683->3682 3685 40603f 18 API calls 3684->3685 3686 405d94 3685->3686 3687 405d9c DeleteFileW 3686->3687 3688 405db3 3686->3688 3692 401951 3687->3692 3689 405ed3 3688->3689 3720 406668 lstrcpynW 3688->3720 3689->3692 3696 40699e 2 API calls 3689->3696 3691 405dd9 3693 405dec 3691->3693 3694 405ddf lstrcatW 3691->3694 3695 405f83 2 API calls 3693->3695 3697 405df2 3694->3697 3695->3697 3699 405ef8 3696->3699 3698 405e02 lstrcatW 3697->3698 3700 405e0d lstrlenW FindFirstFileW 3697->3700 3698->3700 3699->3692 3701 405f37 3 API calls 3699->3701 3700->3689 3718 405e2f 3700->3718 3702 405f02 3701->3702 3704 405d2c 5 API calls 3702->3704 3703 405eb6 FindNextFileW 3707 405ecc FindClose 3703->3707 3703->3718 3706 405f0e 3704->3706 3708 405f12 3706->3708 3709 405f28 3706->3709 3707->3689 3708->3692 3712 4056ca 24 API calls 3708->3712 3711 4056ca 24 API calls 3709->3711 3711->3692 3714 405f1f 3712->3714 3713 405d74 60 API calls 3713->3718 3716 406428 36 API calls 3714->3716 3715 4056ca 24 API calls 3715->3703 3716->3692 3717 4056ca 24 API calls 3717->3718 3718->3703 3718->3713 3718->3715 3718->3717 3719 406428 36 API calls 3718->3719 3721 406668 lstrcpynW 3718->3721 3722 405d2c 3718->3722 3719->3718 3720->3691 3721->3718 3730 406133 GetFileAttributesW 3722->3730 3725 405d47 RemoveDirectoryW 3728 405d55 3725->3728 3726 405d4f DeleteFileW 3726->3728 3727 405d59 3727->3718 3728->3727 3729 405d65 SetFileAttributesW 3728->3729 3729->3727 3731 405d38 3730->3731 3732 406145 SetFileAttributesW 3730->3732 3731->3725 3731->3726 3731->3727 3732->3731 3733 4015c1 3734 402da6 17 API calls 3733->3734 3735 4015c8 3734->3735 3736 405fe2 4 API calls 3735->3736 3748 4015d1 3736->3748 3737 401631 3738 401663 3737->3738 3739 401636 3737->3739 3743 401423 24 API calls 3738->3743 3752 401423 3739->3752 3740 405f64 CharNextW 3740->3748 3749 40165b 3743->3749 3745 405c16 2 API calls 3745->3748 3746 405c33 5 API calls 3746->3748 3747 40164a SetCurrentDirectoryW 3747->3749 3748->3737 3748->3740 3748->3745 3748->3746 3750 401617 GetFileAttributesW 3748->3750 3751 405b99 4 API calls 3748->3751 3750->3748 3751->3748 3753 4056ca 24 API calls 3752->3753 3754 401431 3753->3754 3755 406668 lstrcpynW 3754->3755 3755->3747 3992 401c43 3993 402d84 17 API calls 3992->3993 3994 401c4a 3993->3994 3995 402d84 17 API calls 3994->3995 3996 401c57 3995->3996 3997 402da6 17 API calls 3996->3997 3998 401c6c 3996->3998 3997->3998 3999 401c7c 3998->3999 4000 402da6 17 API calls 3998->4000 4001 401cd3 3999->4001 4002 401c87 3999->4002 4000->3999 4004 402da6 17 API calls 4001->4004 4003 402d84 17 API calls 4002->4003 4006 401c8c 4003->4006 4005 401cd8 4004->4005 4007 402da6 17 API calls 4005->4007 4008 402d84 17 API calls 4006->4008 4009 401ce1 FindWindowExW 4007->4009 4010 401c98 4008->4010 4013 401d03 4009->4013 4011 401cc3 SendMessageW 4010->4011 4012 401ca5 SendMessageTimeoutW 4010->4012 4011->4013 4012->4013 4021 4028c4 4022 4028ca 4021->4022 4023 4028d2 FindClose 4022->4023 4024 402c2a 4022->4024 4023->4024 4025 4040c5 4026 4040dd 4025->4026 4027 40423e 4025->4027 4026->4027 4028 4040e9 4026->4028 4029 40424f GetDlgItem GetDlgItem 4027->4029 4034 40428f 4027->4034 4031 4040f4 SetWindowPos 4028->4031 4032 404107 4028->4032 4113 4045c4 4029->4113 4030 4042e9 4035 404610 SendMessageW 4030->4035 4043 404239 4030->4043 4031->4032 4036 404110 ShowWindow 4032->4036 4037 404152 4032->4037 4034->4030 4042 401389 2 API calls 4034->4042 4065 4042fb 4035->4065 4044 404130 GetWindowLongW 4036->4044 4045 4041fc 4036->4045 4039 404171 4037->4039 4040 40415a DestroyWindow 4037->4040 4038 404279 SetClassLongW 4041 40140b 2 API calls 4038->4041 4047 404176 SetWindowLongW 4039->4047 4048 404187 4039->4048 4046 40454d 4040->4046 4041->4034 4049 4042c1 4042->4049 4044->4045 4051 404149 ShowWindow 4044->4051 4099 40462b 4045->4099 4046->4043 4058 40457e ShowWindow 4046->4058 4047->4043 4048->4045 4052 404193 GetDlgItem 4048->4052 4049->4030 4053 4042c5 SendMessageW 4049->4053 4051->4037 4056 4041c1 4052->4056 4057 4041a4 SendMessageW IsWindowEnabled 4052->4057 4053->4043 4054 40140b 2 API calls 4054->4065 4055 40454f DestroyWindow EndDialog 4055->4046 4060 4041ce 4056->4060 4063 404215 SendMessageW 4056->4063 4064 4041e1 4056->4064 4070 4041c6 4056->4070 4057->4043 4057->4056 4058->4043 4059 4066a5 17 API calls 4059->4065 4060->4063 4060->4070 4062 4045c4 18 API calls 4062->4065 4063->4045 4066 4041e9 4064->4066 4067 4041fe 4064->4067 4065->4043 4065->4054 4065->4055 4065->4059 4065->4062 4071 4045c4 18 API calls 4065->4071 4087 40448f DestroyWindow 4065->4087 4069 40140b 2 API calls 4066->4069 4068 40140b 2 API calls 4067->4068 4068->4070 4069->4070 4070->4045 4096 40459d 4070->4096 4072 404376 GetDlgItem 4071->4072 4073 404393 ShowWindow EnableWindow 4072->4073 4074 40438b 4072->4074 4116 4045e6 EnableWindow 4073->4116 4074->4073 4076 4043bd EnableWindow 4081 4043d1 4076->4081 4077 4043d6 GetSystemMenu EnableMenuItem SendMessageW 4078 404406 SendMessageW 4077->4078 4077->4081 4078->4081 4080 4040a6 18 API calls 4080->4081 4081->4077 4081->4080 4117 4045f9 SendMessageW 4081->4117 4118 406668 lstrcpynW 4081->4118 4083 404435 lstrlenW 4084 4066a5 17 API calls 4083->4084 4085 40444b SetWindowTextW 4084->4085 4086 401389 2 API calls 4085->4086 4086->4065 4087->4046 4088 4044a9 CreateDialogParamW 4087->4088 4088->4046 4089 4044dc 4088->4089 4090 4045c4 18 API calls 4089->4090 4091 4044e7 GetDlgItem GetWindowRect ScreenToClient SetWindowPos 4090->4091 4092 401389 2 API calls 4091->4092 4093 40452d 4092->4093 4093->4043 4094 404535 ShowWindow 4093->4094 4095 404610 SendMessageW 4094->4095 4095->4046 4097 4045a4 4096->4097 4098 4045aa SendMessageW 4096->4098 4097->4098 4098->4045 4100 4046ee 4099->4100 4101 404643 GetWindowLongW 4099->4101 4100->4043 4101->4100 4102 404658 4101->4102 4102->4100 4103 404685 GetSysColor 4102->4103 4104 404688 4102->4104 4103->4104 4105 404698 SetBkMode 4104->4105 4106 40468e SetTextColor 4104->4106 4107 4046b0 GetSysColor 4105->4107 4108 4046b6 4105->4108 4106->4105 4107->4108 4109 4046c7 4108->4109 4110 4046bd SetBkColor 4108->4110 4109->4100 4111 4046e1 CreateBrushIndirect 4109->4111 4112 4046da DeleteObject 4109->4112 4110->4109 4111->4100 4112->4111 4114 4066a5 17 API calls 4113->4114 4115 4045cf SetDlgItemTextW 4114->4115 4115->4038 4116->4076 4117->4081 4118->4083 4122 4016cc 4123 402da6 17 API calls 4122->4123 4124 4016d2 GetFullPathNameW 4123->4124 4125 4016ec 4124->4125 4131 40170e 4124->4131 4127 40699e 2 API calls 4125->4127 4125->4131 4126 401723 GetShortPathNameW 4128 402c2a 4126->4128 4129 4016fe 4127->4129 4129->4131 4132 406668 lstrcpynW 4129->4132 4131->4126 4131->4128 4132->4131 4133 401e4e GetDC 4134 402d84 17 API calls 4133->4134 4135 401e60 GetDeviceCaps MulDiv ReleaseDC 4134->4135 4136 402d84 17 API calls 4135->4136 4137 401e91 4136->4137 4138 4066a5 17 API calls 4137->4138 4139 401ece CreateFontIndirectW 4138->4139 4140 402638 4139->4140 4140->4140 3896 402950 3897 402da6 17 API calls 3896->3897 3899 40295c 3897->3899 3898 402972 3901 406133 2 API calls 3898->3901 3899->3898 3900 402da6 17 API calls 3899->3900 3900->3898 3902 402978 3901->3902 3924 406158 GetFileAttributesW CreateFileW 3902->3924 3904 402985 3905 402a3b 3904->3905 3906 4029a0 GlobalAlloc 3904->3906 3907 402a23 3904->3907 3908 402a42 DeleteFileW 3905->3908 3909 402a55 3905->3909 3906->3907 3910 4029b9 3906->3910 3911 403371 44 API calls 3907->3911 3908->3909 3925 4035f8 SetFilePointer 3910->3925 3913 402a30 CloseHandle 3911->3913 3913->3905 3914 4029bf 3915 4035e2 ReadFile 3914->3915 3916 4029c8 GlobalAlloc 3915->3916 3917 4029d8 3916->3917 3918 402a0c 3916->3918 3919 403371 44 API calls 3917->3919 3920 40620a WriteFile 3918->3920 3923 4029e5 3919->3923 3921 402a18 GlobalFree 3920->3921 3921->3907 3922 402a03 GlobalFree 3922->3918 3923->3922 3924->3904 3925->3914 4148 403cd5 4149 403ce0 4148->4149 4150 403ce4 4149->4150 4151 403ce7 GlobalAlloc 4149->4151 4151->4150 4152 401956 4153 402da6 17 API calls 4152->4153 4154 40195d lstrlenW 4153->4154 4155 402638 4154->4155 4156 4014d7 4157 402d84 17 API calls 4156->4157 4158 4014dd Sleep 4157->4158 4160 402c2a 4158->4160 3926 4020d8 3927 4020ea 3926->3927 3937 40219c 3926->3937 3928 402da6 17 API calls 3927->3928 3929 4020f1 3928->3929 3931 402da6 17 API calls 3929->3931 3930 401423 24 API calls 3933 4022f6 3930->3933 3932 4020fa 3931->3932 3934 402110 LoadLibraryExW 3932->3934 3935 402102 GetModuleHandleW 3932->3935 3936 402121 3934->3936 3934->3937 3935->3934 3935->3936 3946 406aa4 3936->3946 3937->3930 3940 402132 3943 401423 24 API calls 3940->3943 3944 402142 3940->3944 3941 40216b 3942 4056ca 24 API calls 3941->3942 3942->3944 3943->3944 3944->3933 3945 40218e FreeLibrary 3944->3945 3945->3933 3951 40668a WideCharToMultiByte 3946->3951 3948 406ac1 3949 406ac8 GetProcAddress 3948->3949 3950 40212c 3948->3950 3949->3950 3950->3940 3950->3941 3951->3948 4161 402b59 4162 402b60 4161->4162 4163 402bab 4161->4163 4165 402ba9 4162->4165 4167 402d84 17 API calls 4162->4167 4164 406a35 5 API calls 4163->4164 4166 402bb2 4164->4166 4168 402da6 17 API calls 4166->4168 4169 402b6e 4167->4169 4170 402bbb 4168->4170 4171 402d84 17 API calls 4169->4171 4170->4165 4172 402bbf IIDFromString 4170->4172 4174 402b7a 4171->4174 4172->4165 4173 402bce 4172->4173 4173->4165 4179 406668 lstrcpynW 4173->4179 4178 4065af wsprintfW 4174->4178 4177 402beb CoTaskMemFree 4177->4165 4178->4165 4179->4177 4180 402a5b 4181 402d84 17 API calls 4180->4181 4182 402a61 4181->4182 4183 402aa4 4182->4183 4184 402a88 4182->4184 4189 40292e 4182->4189 4186 402abe 4183->4186 4187 402aae 4183->4187 4185 402a8d 4184->4185 4193 402a9e 4184->4193 4194 406668 lstrcpynW 4185->4194 4188 4066a5 17 API calls 4186->4188 4190 402d84 17 API calls 4187->4190 4188->4193 4190->4193 4193->4189 4195 4065af wsprintfW 4193->4195 4194->4189 4195->4189 3975 40175c 3976 402da6 17 API calls 3975->3976 3977 401763 3976->3977 3978 406187 2 API calls 3977->3978 3979 40176a 3978->3979 3980 406187 2 API calls 3979->3980 3980->3979 4196 401d5d 4197 402d84 17 API calls 4196->4197 4198 401d6e SetWindowLongW 4197->4198 4199 402c2a 4198->4199 4200 4028de 4201 4028e6 4200->4201 4202 4028ea FindNextFileW 4201->4202 4204 4028fc 4201->4204 4203 402943 4202->4203 4202->4204 4206 406668 lstrcpynW 4203->4206 4206->4204 4207 406d5f 4213 406be3 4207->4213 4208 40754e 4209 406c64 GlobalFree 4210 406c6d GlobalAlloc 4209->4210 4210->4208 4210->4213 4211 406ce4 GlobalAlloc 4211->4208 4211->4213 4212 406cdb GlobalFree 4212->4211 4213->4208 4213->4209 4213->4210 4213->4211 4213->4212 4214 401563 4215 402ba4 4214->4215 4218 4065af wsprintfW 4215->4218 4217 402ba9 4218->4217 4219 401968 4220 402d84 17 API calls 4219->4220 4221 40196f 4220->4221 4222 402d84 17 API calls 4221->4222 4223 40197c 4222->4223 4224 402da6 17 API calls 4223->4224 4225 401993 lstrlenW 4224->4225 4227 4019a4 4225->4227 4226 4019e5 4227->4226 4231 406668 lstrcpynW 4227->4231 4229 4019d5 4229->4226 4230 4019da lstrlenW 4229->4230 4230->4226 4231->4229 4239 40166a 4240 402da6 17 API calls 4239->4240 4241 401670 4240->4241 4242 40699e 2 API calls 4241->4242 4243 401676 4242->4243 4244 402aeb 4245 402d84 17 API calls 4244->4245 4246 402af1 4245->4246 4247 4066a5 17 API calls 4246->4247 4248 40292e 4246->4248 4247->4248 4249 4026ec 4250 402d84 17 API calls 4249->4250 4251 4026fb 4250->4251 4252 402745 ReadFile 4251->4252 4253 4061db ReadFile 4251->4253 4255 402785 MultiByteToWideChar 4251->4255 4256 40283a 4251->4256 4258 4027ab SetFilePointer MultiByteToWideChar 4251->4258 4259 40284b 4251->4259 4261 402838 4251->4261 4262 406239 SetFilePointer 4251->4262 4252->4251 4252->4261 4253->4251 4255->4251 4271 4065af wsprintfW 4256->4271 4258->4251 4260 40286c SetFilePointer 4259->4260 4259->4261 4260->4261 4263 406255 4262->4263 4266 40626d 4262->4266 4264 4061db ReadFile 4263->4264 4265 406261 4264->4265 4265->4266 4267 406276 SetFilePointer 4265->4267 4268 40629e SetFilePointer 4265->4268 4266->4251 4267->4268 4269 406281 4267->4269 4268->4266 4270 40620a WriteFile 4269->4270 4270->4266 4271->4261 4272 404a6e 4273 404aa4 4272->4273 4274 404a7e 4272->4274 4276 40462b 8 API calls 4273->4276 4275 4045c4 18 API calls 4274->4275 4277 404a8b SetDlgItemTextW 4275->4277 4278 404ab0 4276->4278 4277->4273 3855 40176f 3856 402da6 17 API calls 3855->3856 3857 401776 3856->3857 3858 401796 3857->3858 3859 40179e 3857->3859 3894 406668 lstrcpynW 3858->3894 3895 406668 lstrcpynW 3859->3895 3862 40179c 3866 4068ef 5 API calls 3862->3866 3863 4017a9 3864 405f37 3 API calls 3863->3864 3865 4017af lstrcatW 3864->3865 3865->3862 3886 4017bb 3866->3886 3867 40699e 2 API calls 3867->3886 3868 406133 2 API calls 3868->3886 3870 4017cd CompareFileTime 3870->3886 3871 40188d 3873 4056ca 24 API calls 3871->3873 3872 401864 3874 4056ca 24 API calls 3872->3874 3882 401879 3872->3882 3875 401897 3873->3875 3874->3882 3876 403371 44 API calls 3875->3876 3877 4018aa 3876->3877 3878 4018be SetFileTime 3877->3878 3879 4018d0 CloseHandle 3877->3879 3878->3879 3881 4018e1 3879->3881 3879->3882 3880 4066a5 17 API calls 3880->3886 3884 4018e6 3881->3884 3885 4018f9 3881->3885 3883 406668 lstrcpynW 3883->3886 3887 4066a5 17 API calls 3884->3887 3888 4066a5 17 API calls 3885->3888 3886->3867 3886->3868 3886->3870 3886->3871 3886->3872 3886->3880 3886->3883 3889 405cc8 MessageBoxIndirectW 3886->3889 3893 406158 GetFileAttributesW CreateFileW 3886->3893 3890 4018ee lstrcatW 3887->3890 3891 401901 3888->3891 3889->3886 3890->3891 3892 405cc8 MessageBoxIndirectW 3891->3892 3892->3882 3893->3886 3894->3862 3895->3863 4279 401a72 4280 402d84 17 API calls 4279->4280 4281 401a7b 4280->4281 4282 402d84 17 API calls 4281->4282 4283 401a20 4282->4283 4284 401573 4285 401583 ShowWindow 4284->4285 4286 40158c 4284->4286 4285->4286 4287 402c2a 4286->4287 4288 40159a ShowWindow 4286->4288 4288->4287 4289 4023f4 4290 402da6 17 API calls 4289->4290 4291 402403 4290->4291 4292 402da6 17 API calls 4291->4292 4293 40240c 4292->4293 4294 402da6 17 API calls 4293->4294 4295 402416 GetPrivateProfileStringW 4294->4295 4296 4014f5 SetForegroundWindow 4297 402c2a 4296->4297 4298 401ff6 4299 402da6 17 API calls 4298->4299 4300 401ffd 4299->4300 4301 40699e 2 API calls 4300->4301 4302 402003 4301->4302 4304 402014 4302->4304 4305 4065af wsprintfW 4302->4305 4305->4304 4306 401b77 4307 402da6 17 API calls 4306->4307 4308 401b7e 4307->4308 4309 402d84 17 API calls 4308->4309 4310 401b87 wsprintfW 4309->4310 4311 402c2a 4310->4311 4312 4046fa lstrcpynW lstrlenW 4313 40167b 4314 402da6 17 API calls 4313->4314 4315 401682 4314->4315 4316 402da6 17 API calls 4315->4316 4317 40168b 4316->4317 4318 402da6 17 API calls 4317->4318 4319 401694 MoveFileW 4318->4319 4320 4016a0 4319->4320 4321 4016a7 4319->4321 4323 401423 24 API calls 4320->4323 4322 40699e 2 API calls 4321->4322 4325 4022f6 4321->4325 4324 4016b6 4322->4324 4323->4325 4324->4325 4326 406428 36 API calls 4324->4326 4326->4320 4334 4019ff 4335 402da6 17 API calls 4334->4335 4336 401a06 4335->4336 4337 402da6 17 API calls 4336->4337 4338 401a0f 4337->4338 4339 401a16 lstrcmpiW 4338->4339 4340 401a28 lstrcmpW 4338->4340 4341 401a1c 4339->4341 4340->4341 4342 4022ff 4343 402da6 17 API calls 4342->4343 4344 402305 4343->4344 4345 402da6 17 API calls 4344->4345 4346 40230e 4345->4346 4347 402da6 17 API calls 4346->4347 4348 402317 4347->4348 4349 40699e 2 API calls 4348->4349 4350 402320 4349->4350 4351 402331 lstrlenW lstrlenW 4350->4351 4352 402324 4350->4352 4354 4056ca 24 API calls 4351->4354 4353 4056ca 24 API calls 4352->4353 4356 40232c 4352->4356 4353->4356 4355 40236f SHFileOperationW 4354->4355 4355->4352 4355->4356 4357 401000 4358 401037 BeginPaint GetClientRect 4357->4358 4359 40100c DefWindowProcW 4357->4359 4361 4010f3 4358->4361 4362 401179 4359->4362 4363 401073 CreateBrushIndirect FillRect DeleteObject 4361->4363 4364 4010fc 4361->4364 4363->4361 4365 401102 CreateFontIndirectW 4364->4365 4366 401167 EndPaint 4364->4366 4365->4366 4367 401112 6 API calls 4365->4367 4366->4362 4367->4366 4368 401d81 4369 401d94 GetDlgItem 4368->4369 4370 401d87 4368->4370 4372 401d8e 4369->4372 4371 402d84 17 API calls 4370->4371 4371->4372 4373 401dd5 GetClientRect LoadImageW SendMessageW 4372->4373 4375 402da6 17 API calls 4372->4375 4376 401e33 4373->4376 4378 401e3f 4373->4378 4375->4373 4377 401e38 DeleteObject 4376->4377 4376->4378 4377->4378 4379 401503 4380 40150b 4379->4380 4382 40151e 4379->4382 4381 402d84 17 API calls 4380->4381 4381->4382 4383 404783 4384 40479b 4383->4384 4388 4048b5 4383->4388 4389 4045c4 18 API calls 4384->4389 4385 40491f 4386 4049e9 4385->4386 4387 404929 GetDlgItem 4385->4387 4394 40462b 8 API calls 4386->4394 4390 404943 4387->4390 4391 4049aa 4387->4391 4388->4385 4388->4386 4392 4048f0 GetDlgItem SendMessageW 4388->4392 4393 404802 4389->4393 4390->4391 4399 404969 SendMessageW LoadCursorW SetCursor 4390->4399 4391->4386 4395 4049bc 4391->4395 4416 4045e6 EnableWindow 4392->4416 4397 4045c4 18 API calls 4393->4397 4398 4049e4 4394->4398 4400 4049d2 4395->4400 4401 4049c2 SendMessageW 4395->4401 4403 40480f CheckDlgButton 4397->4403 4420 404a32 4399->4420 4400->4398 4406 4049d8 SendMessageW 4400->4406 4401->4400 4402 40491a 4417 404a0e 4402->4417 4414 4045e6 EnableWindow 4403->4414 4406->4398 4409 40482d GetDlgItem 4415 4045f9 SendMessageW 4409->4415 4411 404843 SendMessageW 4412 404860 GetSysColor 4411->4412 4413 404869 SendMessageW SendMessageW lstrlenW SendMessageW SendMessageW 4411->4413 4412->4413 4413->4398 4414->4409 4415->4411 4416->4402 4418 404a21 SendMessageW 4417->4418 4419 404a1c 4417->4419 4418->4385 4419->4418 4423 405c8e ShellExecuteExW 4420->4423 4422 404998 LoadCursorW SetCursor 4422->4391 4423->4422 4424 402383 4425 40238a 4424->4425 4428 40239d 4424->4428 4426 4066a5 17 API calls 4425->4426 4427 402397 4426->4427 4429 405cc8 MessageBoxIndirectW 4427->4429 4429->4428 4430 402c05 SendMessageW 4431 402c2a 4430->4431 4432 402c1f InvalidateRect 4430->4432 4432->4431 3790 401389 3792 401390 3790->3792 3791 4013fe 3792->3791 3793 4013cb MulDiv SendMessageW 3792->3793 3793->3792 4433 405809 4434 4059b3 4433->4434 4435 40582a GetDlgItem GetDlgItem GetDlgItem 4433->4435 4437 4059e4 4434->4437 4438 4059bc GetDlgItem CreateThread CloseHandle 4434->4438 4478 4045f9 SendMessageW 4435->4478 4440 405a0f 4437->4440 4441 405a34 4437->4441 4442 4059fb ShowWindow ShowWindow 4437->4442 4438->4437 4439 40589a 4444 4058a1 GetClientRect GetSystemMetrics SendMessageW SendMessageW 4439->4444 4443 405a6f 4440->4443 4446 405a23 4440->4446 4447 405a49 ShowWindow 4440->4447 4448 40462b 8 API calls 4441->4448 4480 4045f9 SendMessageW 4442->4480 4443->4441 4453 405a7d SendMessageW 4443->4453 4451 4058f3 SendMessageW SendMessageW 4444->4451 4452 40590f 4444->4452 4454 40459d SendMessageW 4446->4454 4449 405a69 4447->4449 4450 405a5b 4447->4450 4459 405a42 4448->4459 4456 40459d SendMessageW 4449->4456 4455 4056ca 24 API calls 4450->4455 4451->4452 4457 405922 4452->4457 4458 405914 SendMessageW 4452->4458 4453->4459 4460 405a96 CreatePopupMenu 4453->4460 4454->4441 4455->4449 4456->4443 4462 4045c4 18 API calls 4457->4462 4458->4457 4461 4066a5 17 API calls 4460->4461 4463 405aa6 AppendMenuW 4461->4463 4464 405932 4462->4464 4465 405ac3 GetWindowRect 4463->4465 4466 405ad6 TrackPopupMenu 4463->4466 4467 40593b ShowWindow 4464->4467 4468 40596f GetDlgItem SendMessageW 4464->4468 4465->4466 4466->4459 4470 405af1 4466->4470 4471 405951 ShowWindow 4467->4471 4472 40595e 4467->4472 4468->4459 4469 405996 SendMessageW SendMessageW 4468->4469 4469->4459 4473 405b0d SendMessageW 4470->4473 4471->4472 4479 4045f9 SendMessageW 4472->4479 4473->4473 4474 405b2a OpenClipboard EmptyClipboard GlobalAlloc GlobalLock 4473->4474 4476 405b4f SendMessageW 4474->4476 4476->4476 4477 405b78 GlobalUnlock SetClipboardData CloseClipboard 4476->4477 4477->4459 4478->4439 4479->4468 4480->4440 3794 40248a 3795 402da6 17 API calls 3794->3795 3796 40249c 3795->3796 3797 402da6 17 API calls 3796->3797 3798 4024a6 3797->3798 3811 402e36 3798->3811 3801 40292e 3802 4024de 3804 4024ea 3802->3804 3815 402d84 3802->3815 3803 402da6 17 API calls 3805 4024d4 lstrlenW 3803->3805 3807 402509 RegSetValueExW 3804->3807 3808 403371 44 API calls 3804->3808 3805->3802 3809 40251f RegCloseKey 3807->3809 3808->3807 3809->3801 3812 402e51 3811->3812 3818 406503 3812->3818 3816 4066a5 17 API calls 3815->3816 3817 402d99 3816->3817 3817->3804 3819 406512 3818->3819 3820 4024b6 3819->3820 3821 40651d RegCreateKeyExW 3819->3821 3820->3801 3820->3802 3820->3803 3821->3820 4481 404e0b 4482 404e37 4481->4482 4483 404e1b 4481->4483 4485 404e6a 4482->4485 4486 404e3d SHGetPathFromIDListW 4482->4486 4492 405cac GetDlgItemTextW 4483->4492 4487 404e54 SendMessageW 4486->4487 4488 404e4d 4486->4488 4487->4485 4490 40140b 2 API calls 4488->4490 4489 404e28 SendMessageW 4489->4482 4490->4487 4492->4489 4493 40290b 4494 402da6 17 API calls 4493->4494 4495 402912 FindFirstFileW 4494->4495 4496 40293a 4495->4496 4500 402925 4495->4500 4501 4065af wsprintfW 4496->4501 4498 402943 4502 406668 lstrcpynW 4498->4502 4501->4498 4502->4500 4503 40190c 4504 401943 4503->4504 4505 402da6 17 API calls 4504->4505 4506 401948 4505->4506 4507 405d74 67 API calls 4506->4507 4508 401951 4507->4508 4509 40190f 4510 402da6 17 API calls 4509->4510 4511 401916 4510->4511 4512 405cc8 MessageBoxIndirectW 4511->4512 4513 40191f 4512->4513 4514 401491 4515 4056ca 24 API calls 4514->4515 4516 401498 4515->4516 4517 402891 4518 402898 4517->4518 4519 402ba9 4517->4519 4520 402d84 17 API calls 4518->4520 4521 40289f 4520->4521 4522 4028ae SetFilePointer 4521->4522 4522->4519 4523 4028be 4522->4523 4525 4065af wsprintfW 4523->4525 4525->4519 4526 401f12 4527 402da6 17 API calls 4526->4527 4528 401f18 4527->4528 4529 402da6 17 API calls 4528->4529 4530 401f21 4529->4530 4531 402da6 17 API calls 4530->4531 4532 401f2a 4531->4532 4533 402da6 17 API calls 4532->4533 4534 401f33 4533->4534 4535 401423 24 API calls 4534->4535 4536 401f3a 4535->4536 4543 405c8e ShellExecuteExW 4536->4543 4538 401f82 4539 406ae0 5 API calls 4538->4539 4541 40292e 4538->4541 4540 401f9f CloseHandle 4539->4540 4540->4541 4543->4538 4544 402f93 4545 402fa5 SetTimer 4544->4545 4546 402fbe 4544->4546 4545->4546 4547 40300c 4546->4547 4548 403012 MulDiv 4546->4548 4549 402fcc wsprintfW SetWindowTextW SetDlgItemTextW 4548->4549 4549->4547 4565 401d17 4566 402d84 17 API calls 4565->4566 4567 401d1d IsWindow 4566->4567 4568 401a20 4567->4568 3952 401b9b 3953 401ba8 3952->3953 3954 401bec 3952->3954 3961 401bbf 3953->3961 3963 401c31 3953->3963 3955 401bf1 3954->3955 3956 401c16 GlobalAlloc 3954->3956 3960 40239d 3955->3960 3971 406668 lstrcpynW 3955->3971 3958 4066a5 17 API calls 3956->3958 3957 4066a5 17 API calls 3959 402397 3957->3959 3958->3963 3967 405cc8 MessageBoxIndirectW 3959->3967 3972 406668 lstrcpynW 3961->3972 3963->3957 3963->3960 3965 401c03 GlobalFree 3965->3960 3966 401bce 3973 406668 lstrcpynW 3966->3973 3967->3960 3969 401bdd 3974 406668 lstrcpynW 3969->3974 3971->3965 3972->3966 3973->3969 3974->3960 4569 40261c 4570 402da6 17 API calls 4569->4570 4571 402623 4570->4571 4574 406158 GetFileAttributesW CreateFileW 4571->4574 4573 40262f 4574->4573 3981 40259e 3982 402de6 17 API calls 3981->3982 3983 4025a8 3982->3983 3984 402d84 17 API calls 3983->3984 3985 4025b1 3984->3985 3986 40292e 3985->3986 3987 4025d9 RegEnumValueW 3985->3987 3988 4025cd RegEnumKeyW 3985->3988 3989 4025ee 3987->3989 3990 4025f5 RegCloseKey 3987->3990 3988->3990 3989->3990 3990->3986 4582 40149e 4583 4014ac PostQuitMessage 4582->4583 4584 40239d 4582->4584 4583->4584 4585 4015a3 4586 402da6 17 API calls 4585->4586 4587 4015aa SetFileAttributesW 4586->4587 4588 4015bc 4587->4588 3756 401fa4 3757 402da6 17 API calls 3756->3757 3758 401faa 3757->3758 3759 4056ca 24 API calls 3758->3759 3760 401fb4 3759->3760 3761 405c4b 2 API calls 3760->3761 3762 401fba 3761->3762 3763 401fdd CloseHandle 3762->3763 3767 40292e 3762->3767 3771 406ae0 WaitForSingleObject 3762->3771 3763->3767 3766 401fcf 3768 401fd4 3766->3768 3769 401fdf 3766->3769 3776 4065af wsprintfW 3768->3776 3769->3763 3772 406afa 3771->3772 3773 406b0c GetExitCodeProcess 3772->3773 3774 406a71 2 API calls 3772->3774 3773->3766 3775 406b01 WaitForSingleObject 3774->3775 3775->3772 3776->3763 3777 403c25 3778 403c40 3777->3778 3779 403c36 CloseHandle 3777->3779 3780 403c54 3778->3780 3781 403c4a CloseHandle 3778->3781 3779->3778 3786 403c82 3780->3786 3781->3780 3784 405d74 67 API calls 3785 403c65 3784->3785 3787 403c90 3786->3787 3788 403c59 3787->3788 3789 403c95 FreeLibrary GlobalFree 3787->3789 3788->3784 3789->3788 3789->3789 3822 40252a 3833 402de6 3822->3833 3825 402da6 17 API calls 3826 40253d 3825->3826 3827 402548 RegQueryValueExW 3826->3827 3831 40292e 3826->3831 3828 40256e RegCloseKey 3827->3828 3829 402568 3827->3829 3828->3831 3829->3828 3838 4065af wsprintfW 3829->3838 3834 402da6 17 API calls 3833->3834 3835 402dfd 3834->3835 3836 4064d5 RegOpenKeyExW 3835->3836 3837 402534 3836->3837 3837->3825 3838->3828 3839 4021aa 3840 402da6 17 API calls 3839->3840 3841 4021b1 3840->3841 3842 402da6 17 API calls 3841->3842 3843 4021bb 3842->3843 3844 402da6 17 API calls 3843->3844 3845 4021c5 3844->3845 3846 402da6 17 API calls 3845->3846 3847 4021cf 3846->3847 3848 402da6 17 API calls 3847->3848 3849 4021d9 3848->3849 3850 402218 CoCreateInstance 3849->3850 3851 402da6 17 API calls 3849->3851 3854 402237 3850->3854 3851->3850 3852 401423 24 API calls 3853 4022f6 3852->3853 3854->3852 3854->3853 4589 40202a 4590 402da6 17 API calls 4589->4590 4591 402031 4590->4591 4592 406a35 5 API calls 4591->4592 4593 402040 4592->4593 4594 4020cc 4593->4594 4595 40205c GlobalAlloc 4593->4595 4595->4594 4596 402070 4595->4596 4597 406a35 5 API calls 4596->4597 4598 402077 4597->4598 4599 406a35 5 API calls 4598->4599 4600 402081 4599->4600 4600->4594 4604 4065af wsprintfW 4600->4604 4602 4020ba 4605 4065af wsprintfW 4602->4605 4604->4602 4605->4594 4613 401a30 4614 402da6 17 API calls 4613->4614 4615 401a39 ExpandEnvironmentStringsW 4614->4615 4616 401a60 4615->4616 4617 401a4d 4615->4617 4617->4616 4618 401a52 lstrcmpW 4617->4618 4618->4616 4619 405031 GetDlgItem GetDlgItem 4620 405083 7 API calls 4619->4620 4621 4052a8 4619->4621 4622 40512a DeleteObject 4620->4622 4623 40511d SendMessageW 4620->4623 4626 40538a 4621->4626 4653 405317 4621->4653 4673 404f7f SendMessageW 4621->4673 4624 405133 4622->4624 4623->4622 4625 40516a 4624->4625 4629 4066a5 17 API calls 4624->4629 4627 4045c4 18 API calls 4625->4627 4628 405436 4626->4628 4632 40529b 4626->4632 4638 4053e3 SendMessageW 4626->4638 4631 40517e 4627->4631 4633 405440 SendMessageW 4628->4633 4634 405448 4628->4634 4630 40514c SendMessageW SendMessageW 4629->4630 4630->4624 4637 4045c4 18 API calls 4631->4637 4635 40462b 8 API calls 4632->4635 4633->4634 4641 405461 4634->4641 4642 40545a ImageList_Destroy 4634->4642 4649 405471 4634->4649 4640 405637 4635->4640 4654 40518f 4637->4654 4638->4632 4644 4053f8 SendMessageW 4638->4644 4639 40537c SendMessageW 4639->4626 4645 40546a GlobalFree 4641->4645 4641->4649 4642->4641 4643 4055eb 4643->4632 4650 4055fd ShowWindow GetDlgItem ShowWindow 4643->4650 4647 40540b 4644->4647 4645->4649 4646 40526a GetWindowLongW SetWindowLongW 4648 405283 4646->4648 4658 40541c SendMessageW 4647->4658 4651 4052a0 4648->4651 4652 405288 ShowWindow 4648->4652 4649->4643 4666 4054ac 4649->4666 4678 404fff 4649->4678 4650->4632 4672 4045f9 SendMessageW 4651->4672 4671 4045f9 SendMessageW 4652->4671 4653->4626 4653->4639 4654->4646 4657 4051e2 SendMessageW 4654->4657 4659 405265 4654->4659 4660 405220 SendMessageW 4654->4660 4661 405234 SendMessageW 4654->4661 4657->4654 4658->4628 4659->4646 4659->4648 4660->4654 4661->4654 4663 4055b6 4664 4055c1 InvalidateRect 4663->4664 4667 4055cd 4663->4667 4664->4667 4665 4054da SendMessageW 4669 4054f0 4665->4669 4666->4665 4666->4669 4667->4643 4687 404f3a 4667->4687 4668 405564 SendMessageW SendMessageW 4668->4669 4669->4663 4669->4668 4671->4632 4672->4621 4674 404fa2 GetMessagePos ScreenToClient SendMessageW 4673->4674 4675 404fde SendMessageW 4673->4675 4676 404fd6 4674->4676 4677 404fdb 4674->4677 4675->4676 4676->4653 4677->4675 4690 406668 lstrcpynW 4678->4690 4680 405012 4691 4065af wsprintfW 4680->4691 4682 40501c 4683 40140b 2 API calls 4682->4683 4684 405025 4683->4684 4692 406668 lstrcpynW 4684->4692 4686 40502c 4686->4666 4693 404e71 4687->4693 4689 404f4f 4689->4643 4690->4680 4691->4682 4692->4686 4694 404e8a 4693->4694 4695 4066a5 17 API calls 4694->4695 4696 404eee 4695->4696 4697 4066a5 17 API calls 4696->4697 4698 404ef9 4697->4698 4699 4066a5 17 API calls 4698->4699 4700 404f0f lstrlenW wsprintfW SetDlgItemTextW 4699->4700 4700->4689 4706 4023b2 4707 4023ba 4706->4707 4710 4023c0 4706->4710 4708 402da6 17 API calls 4707->4708 4708->4710 4709 4023ce 4712 4023dc 4709->4712 4713 402da6 17 API calls 4709->4713 4710->4709 4711 402da6 17 API calls 4710->4711 4711->4709 4714 402da6 17 API calls 4712->4714 4713->4712 4715 4023e5 WritePrivateProfileStringW 4714->4715 4716 404734 lstrlenW 4717 404753 4716->4717 4718 404755 WideCharToMultiByte 4716->4718 4717->4718 4719 402434 4720 402467 4719->4720 4721 40243c 4719->4721 4723 402da6 17 API calls 4720->4723 4722 402de6 17 API calls 4721->4722 4724 402443 4722->4724 4725 40246e 4723->4725 4727 402da6 17 API calls 4724->4727 4729 40247b 4724->4729 4730 402e64 4725->4730 4728 402454 RegDeleteValueW RegCloseKey 4727->4728 4728->4729 4731 402e78 4730->4731 4733 402e71 4730->4733 4731->4733 4734 402ea9 4731->4734 4733->4729 4735 4064d5 RegOpenKeyExW 4734->4735 4736 402ed7 4735->4736 4737 402ee7 RegEnumValueW 4736->4737 4744 402f81 4736->4744 4746 402f0a 4736->4746 4738 402f71 RegCloseKey 4737->4738 4737->4746 4738->4744 4739 402f46 RegEnumKeyW 4740 402f4f RegCloseKey 4739->4740 4739->4746 4741 406a35 5 API calls 4740->4741 4742 402f5f 4741->4742 4742->4744 4745 402f63 RegDeleteKeyW 4742->4745 4743 402ea9 6 API calls 4743->4746 4744->4733 4745->4744 4746->4738 4746->4739 4746->4740 4746->4743 4747 401735 4748 402da6 17 API calls 4747->4748 4749 40173c SearchPathW 4748->4749 4750 401757 4749->4750 4751 404ab5 4752 404ae1 4751->4752 4753 404af2 4751->4753 4812 405cac GetDlgItemTextW 4752->4812 4755 404afe GetDlgItem 4753->4755 4760 404b5d 4753->4760 4758 404b12 4755->4758 4756 404c41 4761 404df0 4756->4761 4814 405cac GetDlgItemTextW 4756->4814 4757 404aec 4759 4068ef 5 API calls 4757->4759 4763 404b26 SetWindowTextW 4758->4763 4764 405fe2 4 API calls 4758->4764 4759->4753 4760->4756 4760->4761 4765 4066a5 17 API calls 4760->4765 4768 40462b 8 API calls 4761->4768 4767 4045c4 18 API calls 4763->4767 4769 404b1c 4764->4769 4770 404bd1 SHBrowseForFolderW 4765->4770 4766 404c71 4771 40603f 18 API calls 4766->4771 4772 404b42 4767->4772 4773 404e04 4768->4773 4769->4763 4777 405f37 3 API calls 4769->4777 4770->4756 4774 404be9 CoTaskMemFree 4770->4774 4775 404c77 4771->4775 4776 4045c4 18 API calls 4772->4776 4778 405f37 3 API calls 4774->4778 4815 406668 lstrcpynW 4775->4815 4779 404b50 4776->4779 4777->4763 4780 404bf6 4778->4780 4813 4045f9 SendMessageW 4779->4813 4783 404c2d SetDlgItemTextW 4780->4783 4788 4066a5 17 API calls 4780->4788 4783->4756 4784 404b56 4786 406a35 5 API calls 4784->4786 4785 404c8e 4787 406a35 5 API calls 4785->4787 4786->4760 4794 404c95 4787->4794 4789 404c15 lstrcmpiW 4788->4789 4789->4783 4792 404c26 lstrcatW 4789->4792 4790 404cd6 4816 406668 lstrcpynW 4790->4816 4792->4783 4793 404cdd 4795 405fe2 4 API calls 4793->4795 4794->4790 4798 405f83 2 API calls 4794->4798 4800 404d2e 4794->4800 4796 404ce3 GetDiskFreeSpaceW 4795->4796 4799 404d07 MulDiv 4796->4799 4796->4800 4798->4794 4799->4800 4802 404f3a 20 API calls 4800->4802 4810 404d9f 4800->4810 4801 404dc2 4817 4045e6 EnableWindow 4801->4817 4804 404d8c 4802->4804 4803 40140b 2 API calls 4803->4801 4806 404da1 SetDlgItemTextW 4804->4806 4807 404d91 4804->4807 4806->4810 4808 404e71 20 API calls 4807->4808 4808->4810 4809 404dde 4809->4761 4811 404a0e SendMessageW 4809->4811 4810->4801 4810->4803 4811->4761 4812->4757 4813->4784 4814->4766 4815->4785 4816->4793 4817->4809 4818 401d38 4819 402d84 17 API calls 4818->4819 4820 401d3f 4819->4820 4821 402d84 17 API calls 4820->4821 4822 401d4b GetDlgItem 4821->4822 4823 402638 4822->4823 4824 4014b8 4825 4014be 4824->4825 4826 401389 2 API calls 4825->4826 4827 4014c6 4826->4827 4828 40563e 4829 405662 4828->4829 4830 40564e 4828->4830 4833 40566a IsWindowVisible 4829->4833 4839 405681 4829->4839 4831 405654 4830->4831 4832 4056ab 4830->4832 4835 404610 SendMessageW 4831->4835 4834 4056b0 CallWindowProcW 4832->4834 4833->4832 4836 405677 4833->4836 4837 40565e 4834->4837 4835->4837 4838 404f7f 5 API calls 4836->4838 4838->4839 4839->4834 4840 404fff 4 API calls 4839->4840 4840->4832 4841 40263e 4842 402652 4841->4842 4843 40266d 4841->4843 4844 402d84 17 API calls 4842->4844 4845 402672 4843->4845 4846 40269d 4843->4846 4855 402659 4844->4855 4848 402da6 17 API calls 4845->4848 4847 402da6 17 API calls 4846->4847 4850 4026a4 lstrlenW 4847->4850 4849 402679 4848->4849 4858 40668a WideCharToMultiByte 4849->4858 4850->4855 4852 40268d lstrlenA 4852->4855 4853 4026e7 4854 4026d1 4854->4853 4856 40620a WriteFile 4854->4856 4855->4853 4855->4854 4857 406239 5 API calls 4855->4857 4856->4853 4857->4854 4858->4852

                                                                                                                                                                                                                                            Executed Functions

                                                                                                                                                                                                                                            Function 00403640 Relevance: 93.2, APIs: 34, Strings: 19, Instructions: 450stringfilecomCOMMON
                                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                                            control_flow_graph 0 403640-403690 SetErrorMode GetVersionExW 1 403692-4036c6 GetVersionExW 0->1 2 4036ca-4036d1 0->2 1->2 3 4036d3 2->3 4 4036db-40371b 2->4 3->4 5 40371d-403725 call 406a35 4->5 6 40372e 4->6 5->6 11 403727 5->11 8 403733-403747 call 4069c5 lstrlenA 6->8 13 403749-403765 call 406a35 * 3 8->13 11->6 20 403776-4037d8 #17 OleInitialize SHGetFileInfoW call 406668 GetCommandLineW call 406668 13->20 21 403767-40376d 13->21 28 4037e1-4037f4 call 405f64 CharNextW 20->28 29 4037da-4037dc 20->29 21->20 25 40376f 21->25 25->20 32 4038eb-4038f1 28->32 29->28 33 4038f7 32->33 34 4037f9-4037ff 32->34 37 40390b-403925 GetTempPathW call 40360f 33->37 35 403801-403806 34->35 36 403808-40380e 34->36 35->35 35->36 38 403810-403814 36->38 39 403815-403819 36->39 47 403927-403945 GetWindowsDirectoryW lstrcatW call 40360f 37->47 48 40397d-403995 DeleteFileW call 4030d0 37->48 38->39 41 4038d9-4038e7 call 405f64 39->41 42 40381f-403825 39->42 41->32 58 4038e9-4038ea 41->58 45 403827-40382e 42->45 46 40383f-403878 42->46 51 403830-403833 45->51 52 403835 45->52 53 403894-4038ce 46->53 54 40387a-40387f 46->54 47->48 62 403947-403977 GetTempPathW lstrcatW SetEnvironmentVariableW * 2 call 40360f 47->62 64 40399b-4039a1 48->64 65 403b6c-403b7a ExitProcess CoUninitialize 48->65 51->46 51->52 52->46 56 4038d0-4038d4 53->56 57 4038d6-4038d8 53->57 54->53 60 403881-403889 54->60 56->57 63 4038f9-403906 call 406668 56->63 57->41 58->32 66 403890 60->66 67 40388b-40388e 60->67 62->48 62->65 63->37 69 4039a7-4039ba call 405f64 64->69 70 403a48-403a4f call 403d17 64->70 72 403b91-403b97 65->72 73 403b7c-403b8b call 405cc8 ExitProcess 65->73 66->53 67->53 67->66 88 403a0c-403a19 69->88 89 4039bc-4039f1 69->89 83 403a54-403a57 70->83 74 403b99-403bae GetCurrentProcess OpenProcessToken 72->74 75 403c0f-403c17 72->75 80 403bb0-403bd9 LookupPrivilegeValueW AdjustTokenPrivileges 74->80 81 403bdf-403bed call 406a35 74->81 84 403c19 75->84 85 403c1c-403c1f ExitProcess 75->85 80->81 95 403bfb-403c06 ExitWindowsEx 81->95 96 403bef-403bf9 81->96 83->65 84->85 90 403a1b-403a29 call 40603f 88->90 91 403a5c-403a70 call 405c33 lstrcatW 88->91 93 4039f3-4039f7 89->93 90->65 104 403a2f-403a45 call 406668 * 2 90->104 107 403a72-403a78 lstrcatW 91->107 108 403a7d-403a97 lstrcatW lstrcmpiW 91->108 98 403a00-403a08 93->98 99 4039f9-4039fe 93->99 95->75 101 403c08-403c0a call 40140b 95->101 96->95 96->101 98->93 103 403a0a 98->103 99->98 99->103 101->75 103->88 104->70 107->108 109 403b6a 108->109 110 403a9d-403aa0 108->110 109->65 112 403aa2-403aa7 call 405b99 110->112 113 403aa9 call 405c16 110->113 119 403aae-403abe SetCurrentDirectoryW 112->119 113->119 121 403ac0-403ac6 call 406668 119->121 122 403acb-403af7 call 406668 119->122 121->122 126 403afc-403b17 call 4066a5 DeleteFileW 122->126 129 403b57-403b61 126->129 130 403b19-403b29 CopyFileW 126->130 129->126 132 403b63-403b65 call 406428 129->132 130->129 131 403b2b-403b4b call 406428 call 4066a5 call 405c4b 130->131 131->129 140 403b4d-403b54 CloseHandle 131->140 132->109 140->129
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • SetErrorMode.KERNEL32(00008001), ref: 00403663
                                                                                                                                                                                                                                            • GetVersionExW.KERNEL32(?), ref: 0040368C
                                                                                                                                                                                                                                            • GetVersionExW.KERNEL32(0000011C), ref: 004036A3
                                                                                                                                                                                                                                            • lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 0040373A
                                                                                                                                                                                                                                            • #17.COMCTL32(00000007,00000009,0000000B), ref: 00403776
                                                                                                                                                                                                                                            • OleInitialize.OLE32(00000000), ref: 0040377D
                                                                                                                                                                                                                                            • SHGetFileInfoW.SHELL32(00421708,00000000,?,000002B4,00000000), ref: 0040379B
                                                                                                                                                                                                                                            • GetCommandLineW.KERNEL32(00429260,NSIS Error), ref: 004037B0
                                                                                                                                                                                                                                            • CharNextW.USER32(00000000,"C:\Users\user\AppData\Local\Temp\nswC086.tmp" /internal 1730911513052455 /force,00000020,"C:\Users\user\AppData\Local\Temp\nswC086.tmp" /internal 1730911513052455 /force,00000000), ref: 004037E9
                                                                                                                                                                                                                                            • GetTempPathW.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,00000000,?), ref: 0040391C
                                                                                                                                                                                                                                            • GetWindowsDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB), ref: 0040392D
                                                                                                                                                                                                                                            • lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 00403939
                                                                                                                                                                                                                                            • GetTempPathW.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp), ref: 0040394D
                                                                                                                                                                                                                                            • lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low), ref: 00403955
                                                                                                                                                                                                                                            • SetEnvironmentVariableW.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low), ref: 00403966
                                                                                                                                                                                                                                            • SetEnvironmentVariableW.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\), ref: 0040396E
                                                                                                                                                                                                                                            • DeleteFileW.KERNEL32(1033), ref: 00403982
                                                                                                                                                                                                                                            • lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\AppData\Local\Temp\nswC086.tmp" /internal 1730911513052455 /force,00000000,?), ref: 00403A69
                                                                                                                                                                                                                                            • lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,0040A328,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\AppData\Local\Temp\nswC086.tmp" /internal 1730911513052455 /force,00000000,?), ref: 00403A78
                                                                                                                                                                                                                                              • Part of subcall function 00405C16: CreateDirectoryW.KERNEL32(?,00000000,00403633,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00405C1C
                                                                                                                                                                                                                                            • lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\AppData\Local\Temp\nswC086.tmp" /internal 1730911513052455 /force,00000000,?), ref: 00403A83
                                                                                                                                                                                                                                            • lstrcmpiW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\AppData\Local\Temp\nswC086.tmp" /internal 1730911513052455 /force,00000000,?), ref: 00403A8F
                                                                                                                                                                                                                                            • SetCurrentDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\), ref: 00403AAF
                                                                                                                                                                                                                                            • DeleteFileW.KERNEL32(00420F08,00420F08,?,6529687,?), ref: 00403B0E
                                                                                                                                                                                                                                            • CopyFileW.KERNEL32(C:\Users\user\AppData\Local\Temp\nswC086.tmp,00420F08,00000001), ref: 00403B21
                                                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000,00420F08,00420F08,?,00420F08,00000000), ref: 00403B4E
                                                                                                                                                                                                                                            • ExitProcess.KERNEL32(?), ref: 00403B6C
                                                                                                                                                                                                                                            • CoUninitialize.COMBASE(?), ref: 00403B71
                                                                                                                                                                                                                                            • ExitProcess.KERNEL32 ref: 00403B8B
                                                                                                                                                                                                                                            • GetCurrentProcess.KERNEL32(00000028,?), ref: 00403B9F
                                                                                                                                                                                                                                            • OpenProcessToken.ADVAPI32(00000000), ref: 00403BA6
                                                                                                                                                                                                                                            • LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403BBA
                                                                                                                                                                                                                                            • AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 00403BD9
                                                                                                                                                                                                                                            • ExitWindowsEx.USER32(00000002,80040002), ref: 00403BFE
                                                                                                                                                                                                                                            • ExitProcess.KERNEL32 ref: 00403C1F
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000009.00000002.2909503270.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909473554.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909531324.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nswC086.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Processlstrcat$ExitFile$Directory$CurrentDeleteEnvironmentPathTempTokenVariableVersionWindows$AdjustCharCloseCommandCopyCreateErrorHandleInfoInitializeLineLookupModeNextOpenPrivilegePrivilegesUninitializeValuelstrcmpilstrlen
                                                                                                                                                                                                                                            • String ID: "C:\Users\user\AppData\Local\Temp\nswC086.tmp" /internal 1730911513052455 /force$.tmp$1033$6529687$C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\nswC086.tmp$C:\Users\user\PCAppStore$C:\Users\user\PCAppStore$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
                                                                                                                                                                                                                                            • API String ID: 2292928366-322043007
                                                                                                                                                                                                                                            • Opcode ID: 54eba713b65b488fe05b557adb658f0301d1077f312d6d7219dab3d109336353
                                                                                                                                                                                                                                            • Instruction ID: d56582c8b11bee4b9d4e83ad1f604629a9588d533935b381636b20c84fba3529
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 54eba713b65b488fe05b557adb658f0301d1077f312d6d7219dab3d109336353
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: D4E1F471A00214AADB20AFB58D45A6E3EB8EB05709F50847FF945B32D1DB7C8A41CB6D
                                                                                                                                                                                                                                            Function 00405D74 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 148filestringCOMMON
                                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                                            control_flow_graph 346 405d74-405d9a call 40603f 349 405db3-405dba 346->349 350 405d9c-405dae DeleteFileW 346->350 352 405dbc-405dbe 349->352 353 405dcd-405ddd call 406668 349->353 351 405f30-405f34 350->351 354 405dc4-405dc7 352->354 355 405ede-405ee3 352->355 361 405dec-405ded call 405f83 353->361 362 405ddf-405dea lstrcatW 353->362 354->353 354->355 355->351 357 405ee5-405ee8 355->357 359 405ef2-405efa call 40699e 357->359 360 405eea-405ef0 357->360 359->351 370 405efc-405f10 call 405f37 call 405d2c 359->370 360->351 365 405df2-405df6 361->365 362->365 366 405e02-405e08 lstrcatW 365->366 367 405df8-405e00 365->367 369 405e0d-405e29 lstrlenW FindFirstFileW 366->369 367->366 367->369 371 405ed3-405ed7 369->371 372 405e2f-405e37 369->372 386 405f12-405f15 370->386 387 405f28-405f2b call 4056ca 370->387 371->355 377 405ed9 371->377 374 405e57-405e6b call 406668 372->374 375 405e39-405e41 372->375 388 405e82-405e8d call 405d2c 374->388 389 405e6d-405e75 374->389 378 405e43-405e4b 375->378 379 405eb6-405ec6 FindNextFileW 375->379 377->355 378->374 382 405e4d-405e55 378->382 379->372 385 405ecc-405ecd FindClose 379->385 382->374 382->379 385->371 386->360 392 405f17-405f26 call 4056ca call 406428 386->392 387->351 397 405eae-405eb1 call 4056ca 388->397 398 405e8f-405e92 388->398 389->379 393 405e77-405e80 call 405d74 389->393 392->351 393->379 397->379 401 405e94-405ea4 call 4056ca call 406428 398->401 402 405ea6-405eac 398->402 401->379 402->379
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • DeleteFileW.KERNEL32(?,?,76233420,76232EE0,00000000), ref: 00405D9D
                                                                                                                                                                                                                                            • lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\nscF90.tmp\*.*,\*.*,C:\Users\user\AppData\Local\Temp\nscF90.tmp\*.*,?,?,76233420,76232EE0,00000000), ref: 00405DE5
                                                                                                                                                                                                                                            • lstrcatW.KERNEL32(?,0040A014,?,C:\Users\user\AppData\Local\Temp\nscF90.tmp\*.*,?,?,76233420,76232EE0,00000000), ref: 00405E08
                                                                                                                                                                                                                                            • lstrlenW.KERNEL32(?,?,0040A014,?,C:\Users\user\AppData\Local\Temp\nscF90.tmp\*.*,?,?,76233420,76232EE0,00000000), ref: 00405E0E
                                                                                                                                                                                                                                            • FindFirstFileW.KERNEL32(C:\Users\user\AppData\Local\Temp\nscF90.tmp\*.*,?,?,?,0040A014,?,C:\Users\user\AppData\Local\Temp\nscF90.tmp\*.*,?,?,76233420,76232EE0,00000000), ref: 00405E1E
                                                                                                                                                                                                                                            • FindNextFileW.KERNELBASE(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405EBE
                                                                                                                                                                                                                                            • FindClose.KERNEL32(00000000), ref: 00405ECD
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000009.00000002.2909503270.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909473554.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909531324.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nswC086.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
                                                                                                                                                                                                                                            • String ID: .$.$C:\Users\user\AppData\Local\Temp\nscF90.tmp\*.*$\*.*
                                                                                                                                                                                                                                            • API String ID: 2035342205-1074299615
                                                                                                                                                                                                                                            • Opcode ID: eb4081a649fdbb44c8907daec76b44e1c805ca5b036c6d0867ef95af4715127c
                                                                                                                                                                                                                                            • Instruction ID: 3801e3340fbbb9c460ab277ab089a7ece50ce31247a5b640c745bca9484d7288
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: eb4081a649fdbb44c8907daec76b44e1c805ca5b036c6d0867ef95af4715127c
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 46410330800A15AADB21AB61CC49BBF7678EF41715F50413FF881711D1DB7C4A82CEAE
                                                                                                                                                                                                                                            Function 00406D5F Relevance: 5.4, APIs: 4, Instructions: 382COMMON
                                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                                            control_flow_graph 589 406d5f-406d64 590 406dd5-406df3 589->590 591 406d66-406d95 589->591 592 4073cb-4073e0 590->592 593 406d97-406d9a 591->593 594 406d9c-406da0 591->594 595 4073e2-4073f8 592->595 596 4073fa-407410 592->596 597 406dac-406daf 593->597 598 406da2-406da6 594->598 599 406da8 594->599 600 407413-40741a 595->600 596->600 601 406db1-406dba 597->601 602 406dcd-406dd0 597->602 598->597 599->597 606 407441-40744d 600->606 607 40741c-407420 600->607 603 406dbc 601->603 604 406dbf-406dcb 601->604 605 406fa2-406fc0 602->605 603->604 608 406e35-406e63 604->608 612 406fc2-406fd6 605->612 613 406fd8-406fea 605->613 615 406be3-406bec 606->615 609 407426-40743e 607->609 610 4075cf-4075d9 607->610 616 406e65-406e7d 608->616 617 406e7f-406e99 608->617 609->606 614 4075e5-4075f8 610->614 618 406fed-406ff7 612->618 613->618 622 4075fd-407601 614->622 619 406bf2 615->619 620 4075fa 615->620 621 406e9c-406ea6 616->621 617->621 623 406ff9 618->623 624 406f9a-406fa0 618->624 626 406bf9-406bfd 619->626 627 406d39-406d5a 619->627 628 406c9e-406ca2 619->628 629 406d0e-406d12 619->629 620->622 631 406eac 621->631 632 406e1d-406e23 621->632 640 407581-40758b 623->640 641 406f7f-406f97 623->641 624->605 630 406f3e-406f48 624->630 626->614 633 406c03-406c10 626->633 627->592 642 406ca8-406cc1 628->642 643 40754e-407558 628->643 634 406d18-406d2c 629->634 635 40755d-407567 629->635 636 40758d-407597 630->636 637 406f4e-407117 630->637 648 406e02-406e1a 631->648 649 407569-407573 631->649 638 406ed6-406edc 632->638 639 406e29-406e2f 632->639 633->620 647 406c16-406c5c 633->647 650 406d2f-406d37 634->650 635->614 636->614 637->615 645 406f3a 638->645 646 406ede-406efc 638->646 639->608 639->645 640->614 641->624 652 406cc4-406cc8 642->652 643->614 645->630 653 406f14-406f26 646->653 654 406efe-406f12 646->654 655 406c84-406c86 647->655 656 406c5e-406c62 647->656 648->632 649->614 650->627 650->629 652->628 657 406cca-406cd0 652->657 660 406f29-406f33 653->660 654->660 663 406c94-406c9c 655->663 664 406c88-406c92 655->664 661 406c64-406c67 GlobalFree 656->661 662 406c6d-406c7b GlobalAlloc 656->662 658 406cd2-406cd9 657->658 659 406cfa-406d0c 657->659 665 406ce4-406cf4 GlobalAlloc 658->665 666 406cdb-406cde GlobalFree 658->666 659->650 660->638 667 406f35 660->667 661->662 662->620 668 406c81 662->668 663->652 664->663 664->664 665->620 665->659 666->665 670 407575-40757f 667->670 671 406ebb-406ed3 667->671 668->655 670->614 671->638
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000009.00000002.2909503270.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909473554.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909531324.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nswC086.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                                                            • Opcode ID: 6ae840c17bc4cb012e3c6e2f9739eb08ea49decd14d2b7f73774d31e5ba5825a
                                                                                                                                                                                                                                            • Instruction ID: 02c1e40b0c9780dd067322b7733c474732bd0f187a49f53fd7fd3c108ee94619
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 6ae840c17bc4cb012e3c6e2f9739eb08ea49decd14d2b7f73774d31e5ba5825a
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 7CF15570D04229CBDF28CFA8C8946ADBBB0FF44305F24816ED456BB281D7386A86DF45
                                                                                                                                                                                                                                            Function 0040699E Relevance: 3.0, APIs: 2, Instructions: 14fileCOMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • FindFirstFileW.KERNEL32(?,00426798,00425F50,00406088,00425F50,00425F50,00000000,00425F50,00425F50, 4#v.#v,?,76232EE0,00405D94,?,76233420,76232EE0), ref: 004069A9
                                                                                                                                                                                                                                            • FindClose.KERNEL32(00000000), ref: 004069B5
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000009.00000002.2909503270.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909473554.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909531324.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nswC086.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Find$CloseFileFirst
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 2295610775-0
                                                                                                                                                                                                                                            • Opcode ID: 1093b80bdde5f117a2aeaff90f04fc035896fcf98737a4a628a8a679d5dfa397
                                                                                                                                                                                                                                            • Instruction ID: 0ca7534fdffec89160a31ceabb6ef5ff718bfc83d1618d69d17f9e635378cbc3
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 1093b80bdde5f117a2aeaff90f04fc035896fcf98737a4a628a8a679d5dfa397
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 5ED012B15192205FC34057387E0C84B7A989F563317268A36B4AAF11E0CB348C3297AC
                                                                                                                                                                                                                                            Function 00403D17 Relevance: 45.7, APIs: 13, Strings: 13, Instructions: 215stringregistryCOMMON
                                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                                            control_flow_graph 141 403d17-403d2f call 406a35 144 403d31-403d41 call 4065af 141->144 145 403d43-403d7a call 406536 141->145 154 403d9d-403dc6 call 403fed call 40603f 144->154 150 403d92-403d98 lstrcatW 145->150 151 403d7c-403d8d call 406536 145->151 150->154 151->150 159 403e58-403e60 call 40603f 154->159 160 403dcc-403dd1 154->160 166 403e62-403e69 call 4066a5 159->166 167 403e6e-403e93 LoadImageW 159->167 160->159 162 403dd7-403dff call 406536 160->162 162->159 168 403e01-403e05 162->168 166->167 170 403f14-403f1c call 40140b 167->170 171 403e95-403ec5 RegisterClassW 167->171 172 403e17-403e23 lstrlenW 168->172 173 403e07-403e14 call 405f64 168->173 184 403f26-403f31 call 403fed 170->184 185 403f1e-403f21 170->185 174 403fe3 171->174 175 403ecb-403f0f SystemParametersInfoW CreateWindowExW 171->175 179 403e25-403e33 lstrcmpiW 172->179 180 403e4b-403e53 call 405f37 call 406668 172->180 173->172 178 403fe5-403fec 174->178 175->170 179->180 183 403e35-403e3f GetFileAttributesW 179->183 180->159 187 403e41-403e43 183->187 188 403e45-403e46 call 405f83 183->188 194 403f37-403f51 ShowWindow call 4069c5 184->194 195 403fba-403fc2 call 40579d 184->195 185->178 187->180 187->188 188->180 200 403f53-403f58 call 4069c5 194->200 201 403f5d-403f6f GetClassInfoW 194->201 202 403fc4-403fca 195->202 203 403fdc-403fde call 40140b 195->203 200->201 206 403f71-403f81 GetClassInfoW RegisterClassW 201->206 207 403f87-403fb8 DialogBoxParamW call 40140b call 403c67 201->207 202->185 208 403fd0-403fd7 call 40140b 202->208 203->174 206->207 207->178 208->185
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                              • Part of subcall function 00406A35: GetModuleHandleA.KERNEL32(?,00000020,?,00403750,0000000B), ref: 00406A47
                                                                                                                                                                                                                                              • Part of subcall function 00406A35: GetProcAddress.KERNEL32(00000000,?), ref: 00406A62
                                                                                                                                                                                                                                            • lstrcatW.KERNEL32(1033,00423748,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423748,00000000,00000002,76233420,C:\Users\user\AppData\Local\Temp\,?,00000000,?), ref: 00403D98
                                                                                                                                                                                                                                            • lstrlenW.KERNEL32(get,?,?,?,get,00000000,C:\Users\user\PCAppStore,1033,00423748,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423748,00000000,00000002,76233420), ref: 00403E18
                                                                                                                                                                                                                                            • lstrcmpiW.KERNEL32(?,.exe,get,?,?,?,get,00000000,C:\Users\user\PCAppStore,1033,00423748,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423748,00000000), ref: 00403E2B
                                                                                                                                                                                                                                            • GetFileAttributesW.KERNEL32(get,?,00000000,?), ref: 00403E36
                                                                                                                                                                                                                                            • LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,C:\Users\user\PCAppStore), ref: 00403E7F
                                                                                                                                                                                                                                              • Part of subcall function 004065AF: wsprintfW.USER32 ref: 004065BC
                                                                                                                                                                                                                                            • RegisterClassW.USER32(00429200), ref: 00403EBC
                                                                                                                                                                                                                                            • SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403ED4
                                                                                                                                                                                                                                            • CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403F09
                                                                                                                                                                                                                                            • ShowWindow.USER32(00000005,00000000,?,00000000,?), ref: 00403F3F
                                                                                                                                                                                                                                            • GetClassInfoW.USER32(00000000,RichEdit20W,00429200), ref: 00403F6B
                                                                                                                                                                                                                                            • GetClassInfoW.USER32(00000000,RichEdit,00429200), ref: 00403F78
                                                                                                                                                                                                                                            • RegisterClassW.USER32(00429200), ref: 00403F81
                                                                                                                                                                                                                                            • DialogBoxParamW.USER32(?,00000000,004040C5,00000000), ref: 00403FA0
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000009.00000002.2909503270.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909473554.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909531324.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nswC086.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
                                                                                                                                                                                                                                            • String ID: .DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\PCAppStore$Control Panel\Desktop\ResourceLocale$H7B$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb$get
                                                                                                                                                                                                                                            • API String ID: 1975747703-3588531748
                                                                                                                                                                                                                                            • Opcode ID: 78a63079156de9a95659751e2075cee6996798d0e51b0c114acce594fd97feca
                                                                                                                                                                                                                                            • Instruction ID: e235badc60aeba35c86cf297cd954ec43a22164425911800af60bc979c7621a1
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 78a63079156de9a95659751e2075cee6996798d0e51b0c114acce594fd97feca
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: E661D570640201BAD730AF66AD45E2B3A7CEB84B49F40457FF945B22E1DB3D5911CA3D
                                                                                                                                                                                                                                            Function 004030D0 Relevance: 24.7, APIs: 5, Strings: 9, Instructions: 204memoryCOMMON
                                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                                            control_flow_graph 215 4030d0-40311e GetTickCount GetModuleFileNameW call 406158 218 403120-403125 215->218 219 40312a-403158 call 406668 call 405f83 call 406668 GetFileSize 215->219 220 40336a-40336e 218->220 227 403243-403251 call 40302e 219->227 228 40315e 219->228 234 403322-403327 227->234 235 403257-40325a 227->235 230 403163-40317a 228->230 232 40317c 230->232 233 40317e-403187 call 4035e2 230->233 232->233 241 40318d-403194 233->241 242 4032de-4032e6 call 40302e 233->242 234->220 237 403286-4032d2 GlobalAlloc call 406b90 call 406187 CreateFileW 235->237 238 40325c-403274 call 4035f8 call 4035e2 235->238 266 4032d4-4032d9 237->266 267 4032e8-403318 call 4035f8 call 403371 237->267 238->234 261 40327a-403280 238->261 246 403210-403214 241->246 247 403196-4031aa call 406113 241->247 242->234 251 403216-40321d call 40302e 246->251 252 40321e-403224 246->252 247->252 264 4031ac-4031b3 247->264 251->252 257 403233-40323b 252->257 258 403226-403230 call 406b22 252->258 257->230 265 403241 257->265 258->257 261->234 261->237 264->252 270 4031b5-4031bc 264->270 265->227 266->220 276 40331d-403320 267->276 270->252 272 4031be-4031c5 270->272 272->252 273 4031c7-4031ce 272->273 273->252 275 4031d0-4031f0 273->275 275->234 277 4031f6-4031fa 275->277 276->234 278 403329-40333a 276->278 279 403202-40320a 277->279 280 4031fc-403200 277->280 281 403342-403347 278->281 282 40333c 278->282 279->252 283 40320c-40320e 279->283 280->265 280->279 284 403348-40334e 281->284 282->281 283->252 284->284 285 403350-403368 call 406113 284->285 285->220
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • GetTickCount.KERNEL32 ref: 004030E4
                                                                                                                                                                                                                                            • GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\AppData\Local\Temp\nswC086.tmp,00000400), ref: 00403100
                                                                                                                                                                                                                                              • Part of subcall function 00406158: GetFileAttributesW.KERNEL32(00000003,00403113,C:\Users\user\AppData\Local\Temp\nswC086.tmp,80000000,00000003), ref: 0040615C
                                                                                                                                                                                                                                              • Part of subcall function 00406158: CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000), ref: 0040617E
                                                                                                                                                                                                                                            • GetFileSize.KERNEL32(00000000,00000000,00439000,00000000,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp\nswC086.tmp,C:\Users\user\AppData\Local\Temp\nswC086.tmp,80000000,00000003), ref: 00403149
                                                                                                                                                                                                                                            • GlobalAlloc.KERNEL32(00000040,?), ref: 0040328B
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000009.00000002.2909503270.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909473554.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909531324.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nswC086.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
                                                                                                                                                                                                                                            • String ID: C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\nswC086.tmp$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
                                                                                                                                                                                                                                            • API String ID: 2803837635-1976128585
                                                                                                                                                                                                                                            • Opcode ID: dff409350d06ce17b221650d583fb97333c6afb1e6ebf9b4c6eec62bfd946937
                                                                                                                                                                                                                                            • Instruction ID: 6a7077609e6cbe8902eef3654a796be60faa9129f620d49927b75729aeb44cd1
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: dff409350d06ce17b221650d583fb97333c6afb1e6ebf9b4c6eec62bfd946937
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 74710271A40204ABDB20DFB5DD85B9E3AACAB04315F21457FF901B72D2CB789E418B6D
                                                                                                                                                                                                                                            Function 004066A5 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 196stringCOMMON
                                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                                            control_flow_graph 288 4066a5-4066b0 289 4066b2-4066c1 288->289 290 4066c3-4066d9 288->290 289->290 291 4066f1-4066fa 290->291 292 4066db-4066e8 290->292 294 406700 291->294 295 4068d5-4068e0 291->295 292->291 293 4066ea-4066ed 292->293 293->291 296 406705-406712 294->296 297 4068e2-4068e6 call 406668 295->297 298 4068eb-4068ec 295->298 296->295 299 406718-406721 296->299 297->298 301 4068b3 299->301 302 406727-406764 299->302 303 4068c1-4068c4 301->303 304 4068b5-4068bf 301->304 305 406857-40685c 302->305 306 40676a-406771 302->306 307 4068c6-4068cf 303->307 304->307 308 40685e-406864 305->308 309 40688f-406894 305->309 310 406773-406775 306->310 311 406776-406778 306->311 307->295 312 406702 307->312 313 406874-406880 call 406668 308->313 314 406866-406872 call 4065af 308->314 317 4068a3-4068b1 lstrlenW 309->317 318 406896-40689e call 4066a5 309->318 310->311 315 4067b5-4067b8 311->315 316 40677a-4067a1 call 406536 311->316 312->296 329 406885-40688b 313->329 314->329 319 4067c8-4067cb 315->319 320 4067ba-4067c6 GetSystemDirectoryW 315->320 333 40683e-406842 316->333 335 4067a7-4067b0 call 4066a5 316->335 317->307 318->317 326 406834-406836 319->326 327 4067cd-4067db GetWindowsDirectoryW 319->327 325 406838-40683c 320->325 325->333 334 40684f-406855 call 4068ef 325->334 326->325 332 4067dd-4067e5 326->332 327->326 329->317 331 40688d 329->331 331->334 339 4067e7-4067f0 332->339 340 4067fc-406812 SHGetSpecialFolderLocation 332->340 333->334 336 406844-40684a lstrcatW 333->336 334->317 335->325 336->334 345 4067f8-4067fa 339->345 343 406830 340->343 344 406814-40682e SHGetPathFromIDListW CoTaskMemFree 340->344 343->326 344->325 344->343 345->325 345->340
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • GetSystemDirectoryW.KERNEL32(get,00000400), ref: 004067C0
                                                                                                                                                                                                                                            • GetWindowsDirectoryW.KERNEL32(get,00000400,00000000,00422728,?,00405701,00422728,00000000,00000000,00000000,00000000), ref: 004067D3
                                                                                                                                                                                                                                            • lstrcatW.KERNEL32(get,\Microsoft\Internet Explorer\Quick Launch), ref: 0040684A
                                                                                                                                                                                                                                            • lstrlenW.KERNEL32(get,00000000,00422728,?,00405701,00422728,00000000), ref: 004068A4
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000009.00000002.2909503270.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909473554.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909531324.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nswC086.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Directory$SystemWindowslstrcatlstrlen
                                                                                                                                                                                                                                            • String ID: 6529687$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch$get
                                                                                                                                                                                                                                            • API String ID: 4260037668-2637504026
                                                                                                                                                                                                                                            • Opcode ID: a56a8a4d956183f5ceef7ff9e42496adb417aa599aaeb911d527621cdebcfcc9
                                                                                                                                                                                                                                            • Instruction ID: 414c90a3e727c3679fd522760d05a71ccfd37451a898d0680c6fb4b4ce958948
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: a56a8a4d956183f5ceef7ff9e42496adb417aa599aaeb911d527621cdebcfcc9
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: CD61E172A02115EBDB20AF64CD40BAA37A5EF10314F22C13EE946B62D0DB3D49A1CB5D
                                                                                                                                                                                                                                            Function 0040176F Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145stringtimeCOMMON
                                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                                            control_flow_graph 410 40176f-401794 call 402da6 call 405fae 415 401796-40179c call 406668 410->415 416 40179e-4017b0 call 406668 call 405f37 lstrcatW 410->416 421 4017b5-4017b6 call 4068ef 415->421 416->421 425 4017bb-4017bf 421->425 426 4017c1-4017cb call 40699e 425->426 427 4017f2-4017f5 425->427 434 4017dd-4017ef 426->434 435 4017cd-4017db CompareFileTime 426->435 428 4017f7-4017f8 call 406133 427->428 429 4017fd-401819 call 406158 427->429 428->429 437 40181b-40181e 429->437 438 40188d-4018b6 call 4056ca call 403371 429->438 434->427 435->434 439 401820-40185e call 406668 * 2 call 4066a5 call 406668 call 405cc8 437->439 440 40186f-401879 call 4056ca 437->440 450 4018b8-4018bc 438->450 451 4018be-4018ca SetFileTime 438->451 439->425 472 401864-401865 439->472 452 401882-401888 440->452 450->451 454 4018d0-4018db CloseHandle 450->454 451->454 455 402c33 452->455 457 4018e1-4018e4 454->457 458 402c2a-402c2d 454->458 459 402c35-402c39 455->459 462 4018e6-4018f7 call 4066a5 lstrcatW 457->462 463 4018f9-4018fc call 4066a5 457->463 458->455 469 401901-4023a2 call 405cc8 462->469 463->469 469->458 469->459 472->452 474 401867-401868 472->474 474->440
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • lstrcatW.KERNEL32(00000000,00000000,get,C:\Users\user\PCAppStore,?,?,00000031), ref: 004017B0
                                                                                                                                                                                                                                            • CompareFileTime.KERNEL32(-00000014,?,get,get,00000000,00000000,get,C:\Users\user\PCAppStore,?,?,00000031), ref: 004017D5
                                                                                                                                                                                                                                              • Part of subcall function 00406668: lstrcpynW.KERNEL32(?,?,00000400,004037B0,00429260,NSIS Error), ref: 00406675
                                                                                                                                                                                                                                              • Part of subcall function 004056CA: lstrlenW.KERNEL32(00422728,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000,?), ref: 00405702
                                                                                                                                                                                                                                              • Part of subcall function 004056CA: lstrlenW.KERNEL32(004030A8,00422728,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000), ref: 00405712
                                                                                                                                                                                                                                              • Part of subcall function 004056CA: lstrcatW.KERNEL32(00422728,004030A8,004030A8,00422728,00000000,00000000,00000000), ref: 00405725
                                                                                                                                                                                                                                              • Part of subcall function 004056CA: SetWindowTextW.USER32(00422728,00422728), ref: 00405737
                                                                                                                                                                                                                                              • Part of subcall function 004056CA: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040575D
                                                                                                                                                                                                                                              • Part of subcall function 004056CA: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405777
                                                                                                                                                                                                                                              • Part of subcall function 004056CA: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405785
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000009.00000002.2909503270.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909473554.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909531324.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nswC086.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
                                                                                                                                                                                                                                            • String ID: C:\Users\user\AppData\Local\Temp\nscF90.tmp$C:\Users\user\AppData\Local\Temp\nscF90.tmp\inetc.dll$C:\Users\user\PCAppStore$get
                                                                                                                                                                                                                                            • API String ID: 1941528284-3567528761
                                                                                                                                                                                                                                            • Opcode ID: 8a10f81b580edd96727de623d2cb72512ccae63576be40aac63ba19ed1c47bc7
                                                                                                                                                                                                                                            • Instruction ID: 87dd38174d63fc88252c3cacf76d35d2aef1a13c6195c1d88e2760da23471212
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 8a10f81b580edd96727de623d2cb72512ccae63576be40aac63ba19ed1c47bc7
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: DE41B771500205BACF10BBB5CD85DAE7A75EF45328B20473FF422B21E1D63D89619A2E
                                                                                                                                                                                                                                            Function 004069C5 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36libraryCOMMON
                                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                                            control_flow_graph 476 4069c5-4069e5 GetSystemDirectoryW 477 4069e7 476->477 478 4069e9-4069eb 476->478 477->478 479 4069fc-4069fe 478->479 480 4069ed-4069f6 478->480 482 4069ff-406a32 wsprintfW LoadLibraryExW 479->482 480->479 481 4069f8-4069fa 480->481 481->482
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004069DC
                                                                                                                                                                                                                                            • wsprintfW.USER32 ref: 00406A17
                                                                                                                                                                                                                                            • LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 00406A2B
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000009.00000002.2909503270.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909473554.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909531324.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nswC086.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: DirectoryLibraryLoadSystemwsprintf
                                                                                                                                                                                                                                            • String ID: %s%S.dll$UXTHEME$\
                                                                                                                                                                                                                                            • API String ID: 2200240437-1946221925
                                                                                                                                                                                                                                            • Opcode ID: 63130bafcb32548bd4340548baa3f8658423137b3882cd96386db367ad08b740
                                                                                                                                                                                                                                            • Instruction ID: e2ac2e7087162e0187f8b4d6776822ec24d6e31928394cf94a41c199a4feb156
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 63130bafcb32548bd4340548baa3f8658423137b3882cd96386db367ad08b740
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 3AF096B154121DA7DB14AB68DD0EF9B366CAB00705F11447EA646F20E0EB7CDA68CB98
                                                                                                                                                                                                                                            Function 00402950 Relevance: 9.1, APIs: 6, Instructions: 91memoryfileCOMMON
                                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 004029B1
                                                                                                                                                                                                                                            • GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 004029CD
                                                                                                                                                                                                                                            • GlobalFree.KERNEL32(?), ref: 00402A06
                                                                                                                                                                                                                                            • GlobalFree.KERNEL32(00000000), ref: 00402A19
                                                                                                                                                                                                                                            • CloseHandle.KERNEL32(?,?,?,?,?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 00402A35
                                                                                                                                                                                                                                            • DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 00402A48
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000009.00000002.2909503270.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909473554.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909531324.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nswC086.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Global$AllocFree$CloseDeleteFileHandle
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 2667972263-0
                                                                                                                                                                                                                                            • Opcode ID: 3dd095c025195d1a428b75d74b89fb792f772f3b0487a4c6f2200001eeea121b
                                                                                                                                                                                                                                            • Instruction ID: 78b93316678d616cb595922dcd62a83f4062aa2fb33f08fb70827f98fa9650ab
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 3dd095c025195d1a428b75d74b89fb792f772f3b0487a4c6f2200001eeea121b
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: E131B171D00124BBCF216FA9CE89D9EBE79AF09364F10023AF461762E1CB794D429B58
                                                                                                                                                                                                                                            Function 00405B99 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39COMMON
                                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                                            control_flow_graph 519 405b99-405be4 CreateDirectoryW 520 405be6-405be8 519->520 521 405bea-405bf7 GetLastError 519->521 522 405c11-405c13 520->522 521->522 523 405bf9-405c0d SetFileSecurityW 521->523 523->520 524 405c0f GetLastError 523->524 524->522
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • CreateDirectoryW.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\), ref: 00405BDC
                                                                                                                                                                                                                                            • GetLastError.KERNEL32 ref: 00405BF0
                                                                                                                                                                                                                                            • SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 00405C05
                                                                                                                                                                                                                                            • GetLastError.KERNEL32 ref: 00405C0F
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            • C:\Users\user\AppData\Local\Temp\, xrefs: 00405BBF
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000009.00000002.2909503270.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909473554.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909531324.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nswC086.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: ErrorLast$CreateDirectoryFileSecurity
                                                                                                                                                                                                                                            • String ID: C:\Users\user\AppData\Local\Temp\
                                                                                                                                                                                                                                            • API String ID: 3449924974-3936084776
                                                                                                                                                                                                                                            • Opcode ID: 4d8c721838b8a92ea27708fe49d100345a2f80ebd1be40878b53e15a1b169c58
                                                                                                                                                                                                                                            • Instruction ID: 886f74eda6482ab63e8fe18d08a652fea41827dc0a526659a7d7b5e138c44e4e
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 4d8c721838b8a92ea27708fe49d100345a2f80ebd1be40878b53e15a1b169c58
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 95010871D04219EAEF009FA1CD44BEFBBB8EF14314F04403ADA44B6180E7789648CB99
                                                                                                                                                                                                                                            Function 0040248A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64registrystringCOMMON
                                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                                            control_flow_graph 525 40248a-4024bb call 402da6 * 2 call 402e36 532 4024c1-4024cb 525->532 533 402c2a-402c39 525->533 535 4024cd-4024da call 402da6 lstrlenW 532->535 536 4024de-4024e1 532->536 535->536 539 4024e3-4024f4 call 402d84 536->539 540 4024f5-4024f8 536->540 539->540 543 402509-40251d RegSetValueExW 540->543 544 4024fa-402504 call 403371 540->544 546 402522-402603 RegCloseKey 543->546 547 40251f 543->547 544->543 546->533 550 40292e-402935 546->550 547->546 550->533
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\nscF90.tmp,00000023,00000011,00000002), ref: 004024D5
                                                                                                                                                                                                                                            • RegSetValueExW.KERNEL32(?,?,?,?,C:\Users\user\AppData\Local\Temp\nscF90.tmp,00000000,00000011,00000002), ref: 00402515
                                                                                                                                                                                                                                            • RegCloseKey.KERNEL32(?,?,?,C:\Users\user\AppData\Local\Temp\nscF90.tmp,00000000,00000011,00000002), ref: 004025FD
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000009.00000002.2909503270.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909473554.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909531324.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nswC086.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: CloseValuelstrlen
                                                                                                                                                                                                                                            • String ID: C:\Users\user\AppData\Local\Temp\nscF90.tmp
                                                                                                                                                                                                                                            • API String ID: 2655323295-120158718
                                                                                                                                                                                                                                            • Opcode ID: 0c53a365a9c608e81ef79c85193ab9a3ad89e5c6fa2fbf23b50052b3995ee250
                                                                                                                                                                                                                                            • Instruction ID: a516967871aadb8e7373f7254d3c24ec0cdbd982f2b4049ed7d94b0996b6da2b
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 0c53a365a9c608e81ef79c85193ab9a3ad89e5c6fa2fbf23b50052b3995ee250
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 4011AF71E00108BEEF10AFA1CE49EAEB6B8EB44354F11443AF404B61C1DBB98D409658
                                                                                                                                                                                                                                            Function 0040603F Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 47stringCOMMON
                                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                                            control_flow_graph 551 40603f-40605a call 406668 call 405fe2 556 406060-40606d call 4068ef 551->556 557 40605c-40605e 551->557 561 40607d-406081 556->561 562 40606f-406075 556->562 558 4060b8-4060ba 557->558 564 406097-4060a0 lstrlenW 561->564 562->557 563 406077-40607b 562->563 563->557 563->561 565 4060a2-4060b6 call 405f37 GetFileAttributesW 564->565 566 406083-40608a call 40699e 564->566 565->558 571 406091-406092 call 405f83 566->571 572 40608c-40608f 566->572 571->564 572->557 572->571
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                              • Part of subcall function 00406668: lstrcpynW.KERNEL32(?,?,00000400,004037B0,00429260,NSIS Error), ref: 00406675
                                                                                                                                                                                                                                              • Part of subcall function 00405FE2: CharNextW.USER32(?,?,00425F50,?,00406056,00425F50,00425F50, 4#v.#v,?,76232EE0,00405D94,?,76233420,76232EE0,00000000), ref: 00405FF0
                                                                                                                                                                                                                                              • Part of subcall function 00405FE2: CharNextW.USER32(00000000), ref: 00405FF5
                                                                                                                                                                                                                                              • Part of subcall function 00405FE2: CharNextW.USER32(00000000), ref: 0040600D
                                                                                                                                                                                                                                            • lstrlenW.KERNEL32(00425F50,00000000,00425F50,00425F50, 4#v.#v,?,76232EE0,00405D94,?,76233420,76232EE0,00000000), ref: 00406098
                                                                                                                                                                                                                                            • GetFileAttributesW.KERNEL32(00425F50,00425F50,00425F50,00425F50,00425F50,00425F50,00000000,00425F50,00425F50, 4#v.#v,?,76232EE0,00405D94,?,76233420,76232EE0), ref: 004060A8
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000009.00000002.2909503270.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909473554.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909531324.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nswC086.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: CharNext$AttributesFilelstrcpynlstrlen
                                                                                                                                                                                                                                            • String ID: 4#v.#v$P_B
                                                                                                                                                                                                                                            • API String ID: 3248276644-819321360
                                                                                                                                                                                                                                            • Opcode ID: 900e3a3aedd828ccf636743a116f58552bc6887dcb5d3e9637a901da882d1290
                                                                                                                                                                                                                                            • Instruction ID: df110f430b83b9381375b5fd3fa67f6c4419d4890c6468873e0fced3c2676832
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 900e3a3aedd828ccf636743a116f58552bc6887dcb5d3e9637a901da882d1290
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 0DF07826144A1216E622B23A0C05BAF05098F82354B07063FFC93B22E1DF3C8973C43E
                                                                                                                                                                                                                                            Function 00406187 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37COMMON
                                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                                            control_flow_graph 574 406187-406193 575 406194-4061c8 GetTickCount GetTempFileNameW 574->575 576 4061d7-4061d9 575->576 577 4061ca-4061cc 575->577 579 4061d1-4061d4 576->579 577->575 578 4061ce 577->578 578->579
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • GetTickCount.KERNEL32 ref: 004061A5
                                                                                                                                                                                                                                            • GetTempFileNameW.KERNEL32(?,?,00000000,?,?,?,?,0040363E,1033,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 004061C0
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000009.00000002.2909503270.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909473554.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909531324.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nswC086.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: CountFileNameTempTick
                                                                                                                                                                                                                                            • String ID: C:\Users\user\AppData\Local\Temp\$nsa
                                                                                                                                                                                                                                            • API String ID: 1716503409-1857211195
                                                                                                                                                                                                                                            • Opcode ID: 6315ab6e6f8253ba2c88c9b6803a176270f8621abb800126aa0f3c3b7b9ef66c
                                                                                                                                                                                                                                            • Instruction ID: 21b676f9b33da427d45e0b2d6905a63b6509bf3d89a4e990effff8b21c6fdcbe
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 6315ab6e6f8253ba2c88c9b6803a176270f8621abb800126aa0f3c3b7b9ef66c
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: C3F09076700214BFEB008F59DD05E9AB7BCEBA1710F11803AEE05EB180E6B0A9648768
                                                                                                                                                                                                                                            Function 00403C25 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 20COMMON
                                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                                            control_flow_graph 580 403c25-403c34 581 403c40-403c48 580->581 582 403c36-403c39 CloseHandle 580->582 583 403c54-403c60 call 403c82 call 405d74 581->583 584 403c4a-403c4d CloseHandle 581->584 582->581 588 403c65-403c66 583->588 584->583
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • CloseHandle.KERNEL32(FFFFFFFF,C:\Users\user\AppData\Local\Temp\,00403B71,?), ref: 00403C37
                                                                                                                                                                                                                                            • CloseHandle.KERNEL32(FFFFFFFF,C:\Users\user\AppData\Local\Temp\,00403B71,?), ref: 00403C4B
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            • C:\Users\user\AppData\Local\Temp\nscF90.tmp\, xrefs: 00403C5B
                                                                                                                                                                                                                                            • C:\Users\user\AppData\Local\Temp\, xrefs: 00403C2A
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000009.00000002.2909503270.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909473554.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909531324.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nswC086.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: CloseHandle
                                                                                                                                                                                                                                            • String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\nscF90.tmp\
                                                                                                                                                                                                                                            • API String ID: 2962429428-293096483
                                                                                                                                                                                                                                            • Opcode ID: 3450910aa3eb4a83e9339ad550daa728f038e8843dee50fd20da138f79135bda
                                                                                                                                                                                                                                            • Instruction ID: ab9e488bef71b432d29da19662b82269d7b8f1628316f3e3d8f7e3aa77a32ace
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 3450910aa3eb4a83e9339ad550daa728f038e8843dee50fd20da138f79135bda
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 3BE0863244471496E5246F7DAF4D9853B285F413357248726F178F60F0C7389A9B4A9D
                                                                                                                                                                                                                                            Function 004015C1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON
                                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                                            control_flow_graph 672 4015c1-4015d5 call 402da6 call 405fe2 677 401631-401634 672->677 678 4015d7-4015ea call 405f64 672->678 679 401663-4022f6 call 401423 677->679 680 401636-401655 call 401423 call 406668 SetCurrentDirectoryW 677->680 685 401604-401607 call 405c16 678->685 686 4015ec-4015ef 678->686 696 402c2a-402c39 679->696 697 40292e-402935 679->697 680->696 699 40165b-40165e 680->699 695 40160c-40160e 685->695 686->685 689 4015f1-4015f8 call 405c33 686->689 689->685 703 4015fa-4015fd call 405b99 689->703 701 401610-401615 695->701 702 401627-40162f 695->702 697->696 699->696 705 401624 701->705 706 401617-401622 GetFileAttributesW 701->706 702->677 702->678 708 401602 703->708 705->702 706->702 706->705 708->695
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                              • Part of subcall function 00405FE2: CharNextW.USER32(?,?,00425F50,?,00406056,00425F50,00425F50, 4#v.#v,?,76232EE0,00405D94,?,76233420,76232EE0,00000000), ref: 00405FF0
                                                                                                                                                                                                                                              • Part of subcall function 00405FE2: CharNextW.USER32(00000000), ref: 00405FF5
                                                                                                                                                                                                                                              • Part of subcall function 00405FE2: CharNextW.USER32(00000000), ref: 0040600D
                                                                                                                                                                                                                                            • GetFileAttributesW.KERNEL32(?,?,00000000,0000005C,00000000,000000F0), ref: 0040161A
                                                                                                                                                                                                                                              • Part of subcall function 00405B99: CreateDirectoryW.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\), ref: 00405BDC
                                                                                                                                                                                                                                            • SetCurrentDirectoryW.KERNEL32(?,C:\Users\user\PCAppStore,?,00000000,000000F0), ref: 0040164D
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            • C:\Users\user\PCAppStore, xrefs: 00401640
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000009.00000002.2909503270.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909473554.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909531324.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nswC086.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: CharNext$Directory$AttributesCreateCurrentFile
                                                                                                                                                                                                                                            • String ID: C:\Users\user\PCAppStore
                                                                                                                                                                                                                                            • API String ID: 1892508949-4217928965
                                                                                                                                                                                                                                            • Opcode ID: ff9909915b16c23767ee925164981e8f632181fd0fe0b495a8c7e415af322c96
                                                                                                                                                                                                                                            • Instruction ID: a0118e7b9b939ef3ea3e51add98df8039a5aa70d3b8e99a19be4f9c31e9f39fe
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: ff9909915b16c23767ee925164981e8f632181fd0fe0b495a8c7e415af322c96
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 04112231508105EBCF30AFA0CD4099E36A0EF15329B28493BF901B22F1DB3E4982DB5E
                                                                                                                                                                                                                                            Function 00407194 Relevance: 5.2, APIs: 4, Instructions: 236COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000009.00000002.2909503270.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909473554.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909531324.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nswC086.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                                                            • Opcode ID: 9f3cc98df1e3ecd253cf91825a4064c55af45d063240f038e3dc270cc3f81a7c
                                                                                                                                                                                                                                            • Instruction ID: 10cc2cc0f2c892254e5285b7a8bac4c216a70fda8fb68dfa7c3680dd08f727d3
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 9f3cc98df1e3ecd253cf91825a4064c55af45d063240f038e3dc270cc3f81a7c
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 55A15571E04228DBDF28CFA8C8547ADBBB1FF44305F10842AD856BB281D778A986DF45
                                                                                                                                                                                                                                            Function 00407395 Relevance: 5.2, APIs: 4, Instructions: 208COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000009.00000002.2909503270.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909473554.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909531324.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nswC086.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                                                            • Opcode ID: 97748a737734167d5846b9d8dd4738ada3f75d0b833fdafa89234df63502b4a5
                                                                                                                                                                                                                                            • Instruction ID: d49815ad38d406b3cd0a1a90ea7be1526168d9e39684835ffa6a026ef1ef4849
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 97748a737734167d5846b9d8dd4738ada3f75d0b833fdafa89234df63502b4a5
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 91913270D04228DBEF28CF98C8547ADBBB1FF44305F14816AD856BB281D778A986DF45
                                                                                                                                                                                                                                            Function 004070AB Relevance: 5.2, APIs: 4, Instructions: 205COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000009.00000002.2909503270.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909473554.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909531324.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nswC086.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                                                            • Opcode ID: 93c083d05bcdf6195ca23c2a54f1652f9efbc2f2339d63ff2f761c89645e7c92
                                                                                                                                                                                                                                            • Instruction ID: 0a676f48c9952aad729ccf503b6a86ce95496029d8c73069f89f3073be052f6e
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 93c083d05bcdf6195ca23c2a54f1652f9efbc2f2339d63ff2f761c89645e7c92
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: C3813471D08228DFDF24CFA8C8847ADBBB1FB44305F24816AD456BB281D778A986DF05
                                                                                                                                                                                                                                            Function 00406BB0 Relevance: 5.2, APIs: 4, Instructions: 198COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000009.00000002.2909503270.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909473554.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909531324.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nswC086.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                                                            • Opcode ID: 42fe04b556333c9da529a864bcd0db0a91825228453d2ef5331aa29539740558
                                                                                                                                                                                                                                            • Instruction ID: 41bbaa2e3590000dceee7c9791d291245bc26db239967492cd44d063337b5de0
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 42fe04b556333c9da529a864bcd0db0a91825228453d2ef5331aa29539740558
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 3E814831D08228DBEF28CFA8C8447ADBBB1FF44305F14816AD856B7281D778A986DF45
                                                                                                                                                                                                                                            Function 00406FFE Relevance: 5.2, APIs: 4, Instructions: 180COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000009.00000002.2909503270.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909473554.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909531324.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nswC086.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                                                            • Opcode ID: 7ccf24f4e081119859c9f0e48baaaa1d38e3934f3a3b1d8a87677b84cb71901f
                                                                                                                                                                                                                                            • Instruction ID: 4a3513360c1d1cc4287bdabe5afcaa460628bed3c0d7ae87261646ca99be8a9f
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 7ccf24f4e081119859c9f0e48baaaa1d38e3934f3a3b1d8a87677b84cb71901f
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 0D711271D04228DBEF28CF98C9947ADBBF1FB44305F14806AD856B7280D738A986DF05
                                                                                                                                                                                                                                            Function 0040711C Relevance: 5.2, APIs: 4, Instructions: 170COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000009.00000002.2909503270.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909473554.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909531324.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nswC086.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                                                            • Opcode ID: c68610f165bc536a6a66ce61bc987e677a2aaa57ebbfa987bd426c3fc0f92c56
                                                                                                                                                                                                                                            • Instruction ID: aecab3f40db1f9fc07a3dc9ea3777efa7aa3d7dc23f88bc09ddd959c6243594a
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: c68610f165bc536a6a66ce61bc987e677a2aaa57ebbfa987bd426c3fc0f92c56
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 2B711571D04228DBEF28CF98C8547ADBBB1FF44305F14806AD856BB281D778A986DF05
                                                                                                                                                                                                                                            Function 00407068 Relevance: 5.2, APIs: 4, Instructions: 168COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000009.00000002.2909503270.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909473554.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909531324.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nswC086.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                                                            • Opcode ID: b33066b9a67caffcdb2859c2a3d237c195f810e8b6f417b46283b98aba377de3
                                                                                                                                                                                                                                            • Instruction ID: 947ff9f4813c08031b822263453b6bbc7859602ae013fffc9a74d3363ad91bbb
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: b33066b9a67caffcdb2859c2a3d237c195f810e8b6f417b46283b98aba377de3
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: FE713471E04228DBEF28CF98C8547ADBBB1FF44305F15806AD856BB281C778A986DF45
                                                                                                                                                                                                                                            Function 00403479 Relevance: 4.6, APIs: 3, Instructions: 101COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • GetTickCount.KERNEL32 ref: 0040348D
                                                                                                                                                                                                                                              • Part of subcall function 004035F8: SetFilePointer.KERNEL32(00000000,00000000,00000000,004032F6,?), ref: 00403606
                                                                                                                                                                                                                                            • SetFilePointer.KERNEL32(00000000,00000000,?,00000000,004033A3,00000004,00000000,00000000,?,?,0040331D,000000FF,00000000,00000000,?,?), ref: 004034C0
                                                                                                                                                                                                                                            • SetFilePointer.KERNEL32(12F86091,00000000,00000000,00414EF0,00004000,?,00000000,004033A3,00000004,00000000,00000000,?,?,0040331D,000000FF,00000000), ref: 004035BB
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000009.00000002.2909503270.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909473554.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909531324.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nswC086.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: FilePointer$CountTick
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 1092082344-0
                                                                                                                                                                                                                                            • Opcode ID: 3ac154d52ea9800dffc85ef1316eb03f3be91f57b238af8bcd161a90f23d8065
                                                                                                                                                                                                                                            • Instruction ID: 4a0f782daef8a724a5dada35133bb9654e3c612a62d69fcdf17392b9264be50a
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 3ac154d52ea9800dffc85ef1316eb03f3be91f57b238af8bcd161a90f23d8065
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 3A31AEB2650205EFC7209F29EE848263BADF70475A755023BE900B22F1C7B59D42DB9D
                                                                                                                                                                                                                                            Function 004020D8 Relevance: 4.6, APIs: 3, Instructions: 73libraryCOMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • GetModuleHandleW.KERNEL32(00000000,00000001,000000F0), ref: 00402103
                                                                                                                                                                                                                                              • Part of subcall function 004056CA: lstrlenW.KERNEL32(00422728,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000,?), ref: 00405702
                                                                                                                                                                                                                                              • Part of subcall function 004056CA: lstrlenW.KERNEL32(004030A8,00422728,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000), ref: 00405712
                                                                                                                                                                                                                                              • Part of subcall function 004056CA: lstrcatW.KERNEL32(00422728,004030A8,004030A8,00422728,00000000,00000000,00000000), ref: 00405725
                                                                                                                                                                                                                                              • Part of subcall function 004056CA: SetWindowTextW.USER32(00422728,00422728), ref: 00405737
                                                                                                                                                                                                                                              • Part of subcall function 004056CA: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040575D
                                                                                                                                                                                                                                              • Part of subcall function 004056CA: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405777
                                                                                                                                                                                                                                              • Part of subcall function 004056CA: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405785
                                                                                                                                                                                                                                            • LoadLibraryExW.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 00402114
                                                                                                                                                                                                                                            • FreeLibrary.KERNEL32(?,?,000000F7,?,?,00000008,00000001,000000F0), ref: 00402191
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000009.00000002.2909503270.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909473554.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909531324.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nswC086.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: MessageSend$Librarylstrlen$FreeHandleLoadModuleTextWindowlstrcat
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 334405425-0
                                                                                                                                                                                                                                            • Opcode ID: 52f8d756bd50154f6a3dea7293860066d65bf9effb7e174b318ab9c425843f66
                                                                                                                                                                                                                                            • Instruction ID: 1e7e134340f86907485d462c64894228b35b3344cd4f3d252167f9901203d809
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 52f8d756bd50154f6a3dea7293860066d65bf9effb7e174b318ab9c425843f66
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: C521C231904104FADF11AFA5CF48A9D7A70BF48354F60413BF605B91E0DBBD8A929A5D
                                                                                                                                                                                                                                            Function 00401B9B Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 72memoryCOMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • GlobalFree.KERNEL32(03852290), ref: 00401C0B
                                                                                                                                                                                                                                            • GlobalAlloc.KERNEL32(00000040,00000804), ref: 00401C1D
                                                                                                                                                                                                                                              • Part of subcall function 004066A5: lstrcatW.KERNEL32(get,\Microsoft\Internet Explorer\Quick Launch), ref: 0040684A
                                                                                                                                                                                                                                              • Part of subcall function 004066A5: lstrlenW.KERNEL32(get,00000000,00422728,?,00405701,00422728,00000000), ref: 004068A4
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000009.00000002.2909503270.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909473554.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909531324.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nswC086.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Global$AllocFreelstrcatlstrlen
                                                                                                                                                                                                                                            • String ID: get
                                                                                                                                                                                                                                            • API String ID: 3292104215-4248514160
                                                                                                                                                                                                                                            • Opcode ID: 4319b31a17754bffce461f57a5489b402a00cd847fb6eeae40cdae925115eaf0
                                                                                                                                                                                                                                            • Instruction ID: d74cddccbdd50a14e5bf5e3e63826a63b2a65df0fd836753f00777670cd3b466
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 4319b31a17754bffce461f57a5489b402a00cd847fb6eeae40cdae925115eaf0
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 5321D872904210DBDB20EFA4DEC4E5E73A4AB047157150A3BF542F72D0D6BD9C518BAD
                                                                                                                                                                                                                                            Function 0040259E Relevance: 4.5, APIs: 3, Instructions: 47registryCOMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • RegEnumKeyW.ADVAPI32(00000000,00000000,?,000003FF), ref: 004025D1
                                                                                                                                                                                                                                            • RegEnumValueW.ADVAPI32(00000000,00000000,?,?), ref: 004025E4
                                                                                                                                                                                                                                            • RegCloseKey.KERNEL32(?,?,?,C:\Users\user\AppData\Local\Temp\nscF90.tmp,00000000,00000011,00000002), ref: 004025FD
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000009.00000002.2909503270.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909473554.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909531324.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nswC086.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Enum$CloseValue
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 397863658-0
                                                                                                                                                                                                                                            • Opcode ID: a2874957321bf6034ab335a01143add9f6f6121a8284cc98450072ad0413cc1f
                                                                                                                                                                                                                                            • Instruction ID: fdd171a53236be04b49e80cc8c25aaf428e2db1c32e81cf7e645575326a8d696
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: a2874957321bf6034ab335a01143add9f6f6121a8284cc98450072ad0413cc1f
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 35017CB1A04105ABEB159F94DE58AAEB66CEF40348F10403AF501B61D0EBB85E45966D
                                                                                                                                                                                                                                            Function 00405D2C Relevance: 4.5, APIs: 3, Instructions: 28fileCOMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                              • Part of subcall function 00406133: GetFileAttributesW.KERNEL32(?,?,00405D38,?,?,00000000,00405F0E,?,?,?,?), ref: 00406138
                                                                                                                                                                                                                                              • Part of subcall function 00406133: SetFileAttributesW.KERNEL32(?,00000000), ref: 0040614C
                                                                                                                                                                                                                                            • RemoveDirectoryW.KERNEL32(?,?,?,00000000,00405F0E), ref: 00405D47
                                                                                                                                                                                                                                            • DeleteFileW.KERNEL32(?,?,?,00000000,00405F0E), ref: 00405D4F
                                                                                                                                                                                                                                            • SetFileAttributesW.KERNEL32(?,00000000), ref: 00405D67
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000009.00000002.2909503270.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909473554.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909531324.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nswC086.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: File$Attributes$DeleteDirectoryRemove
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 1655745494-0
                                                                                                                                                                                                                                            • Opcode ID: 80ad4dccc83bd5cfbcd7ef077da852fe0cb096cb549a199170c52783d075929e
                                                                                                                                                                                                                                            • Instruction ID: f7500ddcb6900c42920b0fa7cdf939b3a50fd8fb6693fff67202f671924a8b23
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 80ad4dccc83bd5cfbcd7ef077da852fe0cb096cb549a199170c52783d075929e
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 6DE0E531218A9156C3207734AD0CB5B2A98EF86314F09893FF5A2B11E0D77885078AAD
                                                                                                                                                                                                                                            Function 004021AA Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 129comCOMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • CoCreateInstance.OLE32(004084E4,?,00000001,004084D4,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402229
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            • C:\Users\user\PCAppStore, xrefs: 00402269
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000009.00000002.2909503270.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909473554.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909531324.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nswC086.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: CreateInstance
                                                                                                                                                                                                                                            • String ID: C:\Users\user\PCAppStore
                                                                                                                                                                                                                                            • API String ID: 542301482-4217928965
                                                                                                                                                                                                                                            • Opcode ID: 4e8b9e8d9efc1323b126c51a2f9450484e7b2217165b473e9f4f1a567a0bf10e
                                                                                                                                                                                                                                            • Instruction ID: f110e38d5ccd8909b9e85e2ea6b1342c5fae2602ce40754bea02e3b472428d32
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 4e8b9e8d9efc1323b126c51a2f9450484e7b2217165b473e9f4f1a567a0bf10e
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: BC411771A00209EFCF40DFE4C989E9D7BB5BF49304B20456AF505EB2D1DB799981CB94
                                                                                                                                                                                                                                            Function 004064D5 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 19registryCOMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • RegOpenKeyExW.KERNEL32(00000000,00000000,00000000,?,?,00422728,?,('B,00406563,('B,00000000,?,?,get,?), ref: 004064F9
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000009.00000002.2909503270.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909473554.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909531324.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nswC086.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Open
                                                                                                                                                                                                                                            • String ID: ('B
                                                                                                                                                                                                                                            • API String ID: 71445658-2332581011
                                                                                                                                                                                                                                            • Opcode ID: 759d75b29ffd137612e455953a298f0698f5beae901813cd77d6ec234b014f3e
                                                                                                                                                                                                                                            • Instruction ID: 5036765eb4ab6e58186d81024f5778724aa2024cd81e2e1d5ca813995cf5404a
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 759d75b29ffd137612e455953a298f0698f5beae901813cd77d6ec234b014f3e
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: BAD0123210020DBBDF115F90AD01FAB375DAB08310F018426FE06A4092D775D534A728
                                                                                                                                                                                                                                            Function 00403371 Relevance: 3.1, APIs: 2, Instructions: 88COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • SetFilePointer.KERNEL32(?,00000000,00000000,00000000,00000000,?,?,0040331D,000000FF,00000000,00000000,?,?), ref: 00403396
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000009.00000002.2909503270.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909473554.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909531324.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nswC086.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: FilePointer
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 973152223-0
                                                                                                                                                                                                                                            • Opcode ID: b1bf35b654f0c361909532a2badc84153f12731a676864620281ad9f652e4f28
                                                                                                                                                                                                                                            • Instruction ID: 963a71f16df831595788c30304fa9cedbf2cad19eb63879c1ada4fe15c9ed8fa
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: b1bf35b654f0c361909532a2badc84153f12731a676864620281ad9f652e4f28
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 93319F70200219EFDB129F65ED84E9A3FA8FF00355B10443AF905EA1A1D778CE51DBA9
                                                                                                                                                                                                                                            Function 0040252A Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • RegQueryValueExW.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,00000033), ref: 0040255B
                                                                                                                                                                                                                                            • RegCloseKey.KERNEL32(?,?,?,C:\Users\user\AppData\Local\Temp\nscF90.tmp,00000000,00000011,00000002), ref: 004025FD
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000009.00000002.2909503270.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909473554.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909531324.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nswC086.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: CloseQueryValue
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 3356406503-0
                                                                                                                                                                                                                                            • Opcode ID: 2f519eafec3af35988992028302c1fe2ffbfb85c9afca13b7af9384ace0fec36
                                                                                                                                                                                                                                            • Instruction ID: eaee0c709954dca67eb2d1c59e66f6ca2c08a593dad46a4828cc6951ae7b5872
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 2f519eafec3af35988992028302c1fe2ffbfb85c9afca13b7af9384ace0fec36
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 5C116D71900219EBDF14DFA4DE589AE7774FF04345B20443BE401B62D0E7B88A45EB5D
                                                                                                                                                                                                                                            Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
                                                                                                                                                                                                                                            • SendMessageW.USER32(?,00000402,00000000), ref: 004013F4
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000009.00000002.2909503270.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909473554.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909531324.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nswC086.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: MessageSend
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 3850602802-0
                                                                                                                                                                                                                                            • Opcode ID: 09e122a9c5ca6d14e20a0c17f6d9bb0c47d9e5f073d0cae9cf8d248ab6fa9320
                                                                                                                                                                                                                                            • Instruction ID: af17251ef12b8b272b5eaf8d1bef107274ce64b6e67bb2dd4604cf2723900e86
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 09e122a9c5ca6d14e20a0c17f6d9bb0c47d9e5f073d0cae9cf8d248ab6fa9320
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 6F012831724220EBEB295B389D05B6A3698E710714F10857FF855F76F1E678CC029B6D
                                                                                                                                                                                                                                            Function 00405C4B Relevance: 3.0, APIs: 2, Instructions: 24processCOMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00426750,00000000,00000000), ref: 00405C74
                                                                                                                                                                                                                                            • CloseHandle.KERNEL32(?), ref: 00405C81
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000009.00000002.2909503270.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909473554.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909531324.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nswC086.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: CloseCreateHandleProcess
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 3712363035-0
                                                                                                                                                                                                                                            • Opcode ID: ab61a979a714f7ec4effc1a78875f568a822f35fd178278bd28005db307d5d14
                                                                                                                                                                                                                                            • Instruction ID: 91309136e62a13352d93043ad9bb7922807806bb2ea2f765c8e9c4a894a003d9
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: ab61a979a714f7ec4effc1a78875f568a822f35fd178278bd28005db307d5d14
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 59E0B6B4600209BFFB109B64EE09F7B7BADFB04648F414565BD51F2190D778A8158A78
                                                                                                                                                                                                                                            Function 00406A35 Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • GetModuleHandleA.KERNEL32(?,00000020,?,00403750,0000000B), ref: 00406A47
                                                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,?), ref: 00406A62
                                                                                                                                                                                                                                              • Part of subcall function 004069C5: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004069DC
                                                                                                                                                                                                                                              • Part of subcall function 004069C5: wsprintfW.USER32 ref: 00406A17
                                                                                                                                                                                                                                              • Part of subcall function 004069C5: LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 00406A2B
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000009.00000002.2909503270.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909473554.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909531324.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nswC086.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 2547128583-0
                                                                                                                                                                                                                                            • Opcode ID: a89557e88259ac32882439a66efe2bded2b7fe37332f597cb2162f61758b0433
                                                                                                                                                                                                                                            • Instruction ID: 0464b4a7853edb7079d0776797c383171681067eb8499b99987f1e8ea9f8efb8
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: a89557e88259ac32882439a66efe2bded2b7fe37332f597cb2162f61758b0433
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: E0E086727042106AD210A6745D08D3773E8ABC6711307883EF557F2040D738DC359A79
                                                                                                                                                                                                                                            Function 00403C82 Relevance: 3.0, APIs: 2, Instructions: 19COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • FreeLibrary.KERNEL32(?,76233420,00000000,76232EE0,00403C59,C:\Users\user\AppData\Local\Temp\,00403B71,?), ref: 00403C9C
                                                                                                                                                                                                                                            • GlobalFree.KERNEL32(?), ref: 00403CA3
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000009.00000002.2909503270.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909473554.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909531324.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nswC086.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Free$GlobalLibrary
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 1100898210-0
                                                                                                                                                                                                                                            • Opcode ID: e868f33ba05eeb96666b2da3448a48ed76ae7177416a2bb01e196352cb617163
                                                                                                                                                                                                                                            • Instruction ID: 1b4b668df254a36c82b8f96f79c5ae0e05fb6c29bd97d86a5de4613e9375b038
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: e868f33ba05eeb96666b2da3448a48ed76ae7177416a2bb01e196352cb617163
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 0AE08C335052205BD6211F55EA0875A7768AF94B26F06006AE980BB26087781C424BC8
                                                                                                                                                                                                                                            Function 00406158 Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • GetFileAttributesW.KERNEL32(00000003,00403113,C:\Users\user\AppData\Local\Temp\nswC086.tmp,80000000,00000003), ref: 0040615C
                                                                                                                                                                                                                                            • CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000), ref: 0040617E
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000009.00000002.2909503270.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909473554.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909531324.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nswC086.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: File$AttributesCreate
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 415043291-0
                                                                                                                                                                                                                                            • Opcode ID: bc48b18717e6d0ecb647aea7fc0ab07bebcbb2e2e3a0bd9572a83b91cd6509df
                                                                                                                                                                                                                                            • Instruction ID: 0e1b57c135d9ed337dcee0f1630d7a3ffd6699826ab823f4ff8c6da5104765b0
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: bc48b18717e6d0ecb647aea7fc0ab07bebcbb2e2e3a0bd9572a83b91cd6509df
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: DCD09E71254201AFEF0D8F20DF16F2E7AA2EB94B04F11952CB682940E1DAB15C15AB19
                                                                                                                                                                                                                                            Function 00406133 Relevance: 3.0, APIs: 2, Instructions: 13COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • GetFileAttributesW.KERNEL32(?,?,00405D38,?,?,00000000,00405F0E,?,?,?,?), ref: 00406138
                                                                                                                                                                                                                                            • SetFileAttributesW.KERNEL32(?,00000000), ref: 0040614C
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000009.00000002.2909503270.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909473554.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909531324.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nswC086.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: AttributesFile
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 3188754299-0
                                                                                                                                                                                                                                            • Opcode ID: a764032cc0ce64e7f87df91ab84dfb27e8fca44cfd77f22972d2dc2d25b91850
                                                                                                                                                                                                                                            • Instruction ID: 3e6336b5c460747e2e1e0fbe3c4db8defb42c0044e1a92967a1d29a512d2a4bc
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: a764032cc0ce64e7f87df91ab84dfb27e8fca44cfd77f22972d2dc2d25b91850
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 73D0C972514130ABC2102728AE0889ABB56EB64271B014A35F9A5A62B0CB304C628A98
                                                                                                                                                                                                                                            Function 00405C16 Relevance: 3.0, APIs: 2, Instructions: 9COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • CreateDirectoryW.KERNEL32(?,00000000,00403633,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00405C1C
                                                                                                                                                                                                                                            • GetLastError.KERNEL32 ref: 00405C2A
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000009.00000002.2909503270.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909473554.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909531324.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nswC086.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: CreateDirectoryErrorLast
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 1375471231-0
                                                                                                                                                                                                                                            • Opcode ID: 3d774f31bfc7c5d70b6f8c035fc875d1b29c99f0800ffc9da4ab7b914865a185
                                                                                                                                                                                                                                            • Instruction ID: 66e62c5d6c7775ff4cea72667941029308d228c48495a605f612c1d2d9e1fc74
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 3d774f31bfc7c5d70b6f8c035fc875d1b29c99f0800ffc9da4ab7b914865a185
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: FBC04C31218605AEE7605B219F0CB177A94DB50741F114839E186F40A0DA788455D92D
                                                                                                                                                                                                                                            Function 00406503 Relevance: 1.5, APIs: 1, Instructions: 24registryCOMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • RegCreateKeyExW.KERNEL32(00000000,?,00000000,00000000,00000000,?,00000000,?,00000000,?,?,?,00402E57,00000000,?,?), ref: 0040652C
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000009.00000002.2909503270.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909473554.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909531324.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nswC086.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Create
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 2289755597-0
                                                                                                                                                                                                                                            • Opcode ID: f0170b29b94a961cdf0cc122a920c286c7e5b726b195fdee8f598fb45efbb6e4
                                                                                                                                                                                                                                            • Instruction ID: 390987c888b9fe28ccc3a202ccefe0e129b8fdbaba7b34d45eb5723cdb444700
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: f0170b29b94a961cdf0cc122a920c286c7e5b726b195fdee8f598fb45efbb6e4
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: C1E0ECB2010109BEEF099F90EC0ADBB372DEB04704F41492EF907E4091E6B5AE70AA34
                                                                                                                                                                                                                                            Function 0040620A Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • WriteFile.KERNEL32(?,00000000,00000000,00000000,00000000,00412A94,0040CEF0,00403579,0040CEF0,00412A94,00414EF0,00004000,?,00000000,004033A3,00000004), ref: 0040621E
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000009.00000002.2909503270.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909473554.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909531324.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nswC086.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: FileWrite
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 3934441357-0
                                                                                                                                                                                                                                            • Opcode ID: 3dec9289c2e50997f5b7f42c7d661c3d3292bfbb80aff78175bf8fde073ef60e
                                                                                                                                                                                                                                            • Instruction ID: 398385dbb58ca0a44fa402a726e0ab0b2131cea3ae709c8a1b666252059dd88a
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 3dec9289c2e50997f5b7f42c7d661c3d3292bfbb80aff78175bf8fde073ef60e
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: F6E08632141129EBCF10AE548C00EEB375CFB01350F014476F955E3040D330E93087A5
                                                                                                                                                                                                                                            Function 004061DB Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • ReadFile.KERNEL32(?,00000000,00000000,00000000,00000000,00414EF0,0040CEF0,004035F5,?,?,004034F9,00414EF0,00004000,?,00000000,004033A3), ref: 004061EF
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000009.00000002.2909503270.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909473554.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909531324.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nswC086.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: FileRead
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 2738559852-0
                                                                                                                                                                                                                                            • Opcode ID: 0024165f2f5d2011be9120f41fe866c54f7b8e58de784a1218c53157080e4b8c
                                                                                                                                                                                                                                            • Instruction ID: 689b8facb1381159ac92aeccc4703b7db47ce2620db9a14c340ec3ef8a35c8b1
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 0024165f2f5d2011be9120f41fe866c54f7b8e58de784a1218c53157080e4b8c
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: C1E0863250021AABDF10AE518C04AEB375CEB01360F014477F922E2150D230E82187E8
                                                                                                                                                                                                                                            Function 004035F8 Relevance: 1.5, APIs: 1, Instructions: 6COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • SetFilePointer.KERNEL32(00000000,00000000,00000000,004032F6,?), ref: 00403606
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000009.00000002.2909503270.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909473554.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909531324.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nswC086.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: FilePointer
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 973152223-0
                                                                                                                                                                                                                                            • Opcode ID: e1e4f0b9cbde4cef3e4374ef9de0ac4f9a9ec0cef6a377cf2568efe91b529ef4
                                                                                                                                                                                                                                            • Instruction ID: 036c8468b6dd2e012b37e6e875261c5f60c7cf4634656b07e897873a541603b6
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: e1e4f0b9cbde4cef3e4374ef9de0ac4f9a9ec0cef6a377cf2568efe91b529ef4
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 1FB01231140304BFDA214F10DF09F067B21BB94700F20C034B384380F086711435EB0D
                                                                                                                                                                                                                                            Function 00401FA4 Relevance: 1.3, APIs: 1, Instructions: 37COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                              • Part of subcall function 004056CA: lstrlenW.KERNEL32(00422728,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000,?), ref: 00405702
                                                                                                                                                                                                                                              • Part of subcall function 004056CA: lstrlenW.KERNEL32(004030A8,00422728,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000), ref: 00405712
                                                                                                                                                                                                                                              • Part of subcall function 004056CA: lstrcatW.KERNEL32(00422728,004030A8,004030A8,00422728,00000000,00000000,00000000), ref: 00405725
                                                                                                                                                                                                                                              • Part of subcall function 004056CA: SetWindowTextW.USER32(00422728,00422728), ref: 00405737
                                                                                                                                                                                                                                              • Part of subcall function 004056CA: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040575D
                                                                                                                                                                                                                                              • Part of subcall function 004056CA: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405777
                                                                                                                                                                                                                                              • Part of subcall function 004056CA: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405785
                                                                                                                                                                                                                                              • Part of subcall function 00405C4B: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00426750,00000000,00000000), ref: 00405C74
                                                                                                                                                                                                                                              • Part of subcall function 00405C4B: CloseHandle.KERNEL32(?), ref: 00405C81
                                                                                                                                                                                                                                            • CloseHandle.KERNEL32(?,?,?,?,?,?), ref: 00401FEB
                                                                                                                                                                                                                                              • Part of subcall function 00406AE0: WaitForSingleObject.KERNEL32(?,00000064), ref: 00406AF1
                                                                                                                                                                                                                                              • Part of subcall function 00406AE0: GetExitCodeProcess.KERNEL32(?,?), ref: 00406B13
                                                                                                                                                                                                                                              • Part of subcall function 004065AF: wsprintfW.USER32 ref: 004065BC
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000009.00000002.2909503270.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909473554.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909531324.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nswC086.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: MessageSend$CloseHandleProcesslstrlen$CodeCreateExitObjectSingleTextWaitWindowlstrcatwsprintf
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 2972824698-0
                                                                                                                                                                                                                                            • Opcode ID: 39558c5643c496eaffaca9d6483fe6d6b72d5b00fb47a50e88cd8089dc569f6d
                                                                                                                                                                                                                                            • Instruction ID: 7fe263eab699b123ac8c37dffe14ee58438593542e676086741668bd6549bbba
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 39558c5643c496eaffaca9d6483fe6d6b72d5b00fb47a50e88cd8089dc569f6d
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 3DF09072905112EBDF21BBA59AC4DAE76A4DF01318B25453BE102B21E0D77C4E528A6E

                                                                                                                                                                                                                                            Non-executed Functions

                                                                                                                                                                                                                                            Function 00405809 Relevance: 66.8, APIs: 36, Strings: 2, Instructions: 284windowclipboardmemoryCOMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • GetDlgItem.USER32(?,00000403), ref: 00405867
                                                                                                                                                                                                                                            • GetDlgItem.USER32(?,000003EE), ref: 00405876
                                                                                                                                                                                                                                            • GetClientRect.USER32(?,?), ref: 004058B3
                                                                                                                                                                                                                                            • GetSystemMetrics.USER32(00000002), ref: 004058BA
                                                                                                                                                                                                                                            • SendMessageW.USER32(?,00001061,00000000,?), ref: 004058DB
                                                                                                                                                                                                                                            • SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004058EC
                                                                                                                                                                                                                                            • SendMessageW.USER32(?,00001001,00000000,00000110), ref: 004058FF
                                                                                                                                                                                                                                            • SendMessageW.USER32(?,00001026,00000000,00000110), ref: 0040590D
                                                                                                                                                                                                                                            • SendMessageW.USER32(?,00001024,00000000,?), ref: 00405920
                                                                                                                                                                                                                                            • ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 00405942
                                                                                                                                                                                                                                            • ShowWindow.USER32(?,00000008), ref: 00405956
                                                                                                                                                                                                                                            • GetDlgItem.USER32(?,000003EC), ref: 00405977
                                                                                                                                                                                                                                            • SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 00405987
                                                                                                                                                                                                                                            • SendMessageW.USER32(00000000,00000409,00000000,?), ref: 004059A0
                                                                                                                                                                                                                                            • SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 004059AC
                                                                                                                                                                                                                                            • GetDlgItem.USER32(?,000003F8), ref: 00405885
                                                                                                                                                                                                                                              • Part of subcall function 004045F9: SendMessageW.USER32(00000028,?,00000001,00404424), ref: 00404607
                                                                                                                                                                                                                                            • GetDlgItem.USER32(?,000003EC), ref: 004059C9
                                                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,Function_0000579D,00000000), ref: 004059D7
                                                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 004059DE
                                                                                                                                                                                                                                            • ShowWindow.USER32(00000000), ref: 00405A02
                                                                                                                                                                                                                                            • ShowWindow.USER32(?,00000008), ref: 00405A07
                                                                                                                                                                                                                                            • ShowWindow.USER32(00000008), ref: 00405A51
                                                                                                                                                                                                                                            • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405A85
                                                                                                                                                                                                                                            • CreatePopupMenu.USER32 ref: 00405A96
                                                                                                                                                                                                                                            • AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 00405AAA
                                                                                                                                                                                                                                            • GetWindowRect.USER32(?,?), ref: 00405ACA
                                                                                                                                                                                                                                            • TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 00405AE3
                                                                                                                                                                                                                                            • SendMessageW.USER32(?,00001073,00000000,?), ref: 00405B1B
                                                                                                                                                                                                                                            • OpenClipboard.USER32(00000000), ref: 00405B2B
                                                                                                                                                                                                                                            • EmptyClipboard.USER32 ref: 00405B31
                                                                                                                                                                                                                                            • GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405B3D
                                                                                                                                                                                                                                            • GlobalLock.KERNEL32(00000000), ref: 00405B47
                                                                                                                                                                                                                                            • SendMessageW.USER32(?,00001073,00000000,?), ref: 00405B5B
                                                                                                                                                                                                                                            • GlobalUnlock.KERNEL32(00000000), ref: 00405B7B
                                                                                                                                                                                                                                            • SetClipboardData.USER32(0000000D,00000000), ref: 00405B86
                                                                                                                                                                                                                                            • CloseClipboard.USER32 ref: 00405B8C
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000009.00000002.2909503270.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909473554.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909531324.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nswC086.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
                                                                                                                                                                                                                                            • String ID: H7B${
                                                                                                                                                                                                                                            • API String ID: 590372296-2256286769
                                                                                                                                                                                                                                            • Opcode ID: 0185fb71cb0ebac8bb253ddb79263eb6e3c4c27c477fa06c1930d1494c9be16a
                                                                                                                                                                                                                                            • Instruction ID: d0bbb34d81c2c7a38b5cdb5171fa906e4f4201ee6cbe22cb0b3272b57562556b
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 0185fb71cb0ebac8bb253ddb79263eb6e3c4c27c477fa06c1930d1494c9be16a
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: D8B137B0900608FFDF119FA0DD89AAE7B79FB08354F00417AFA45A61A0CB755E52DF68
                                                                                                                                                                                                                                            Function 00405031 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 489windowmemoryCOMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • GetDlgItem.USER32(?,000003F9), ref: 00405049
                                                                                                                                                                                                                                            • GetDlgItem.USER32(?,00000408), ref: 00405054
                                                                                                                                                                                                                                            • GlobalAlloc.KERNEL32(00000040,?), ref: 0040509E
                                                                                                                                                                                                                                            • LoadImageW.USER32(0000006E,00000000,00000000,00000000,00000000), ref: 004050B5
                                                                                                                                                                                                                                            • SetWindowLongW.USER32(?,000000FC,0040563E), ref: 004050CE
                                                                                                                                                                                                                                            • ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 004050E2
                                                                                                                                                                                                                                            • ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 004050F4
                                                                                                                                                                                                                                            • SendMessageW.USER32(?,00001109,00000002), ref: 0040510A
                                                                                                                                                                                                                                            • SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00405116
                                                                                                                                                                                                                                            • SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00405128
                                                                                                                                                                                                                                            • DeleteObject.GDI32(00000000), ref: 0040512B
                                                                                                                                                                                                                                            • SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00405156
                                                                                                                                                                                                                                            • SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00405162
                                                                                                                                                                                                                                            • SendMessageW.USER32(?,00001132,00000000,?), ref: 004051FD
                                                                                                                                                                                                                                            • SendMessageW.USER32(?,0000110A,00000003,00000110), ref: 0040522D
                                                                                                                                                                                                                                              • Part of subcall function 004045F9: SendMessageW.USER32(00000028,?,00000001,00404424), ref: 00404607
                                                                                                                                                                                                                                            • SendMessageW.USER32(?,00001132,00000000,?), ref: 00405241
                                                                                                                                                                                                                                            • GetWindowLongW.USER32(?,000000F0), ref: 0040526F
                                                                                                                                                                                                                                            • SetWindowLongW.USER32(?,000000F0,00000000), ref: 0040527D
                                                                                                                                                                                                                                            • ShowWindow.USER32(?,00000005), ref: 0040528D
                                                                                                                                                                                                                                            • SendMessageW.USER32(?,00000419,00000000,?), ref: 00405388
                                                                                                                                                                                                                                            • SendMessageW.USER32(?,00000147,00000000,00000000), ref: 004053ED
                                                                                                                                                                                                                                            • SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00405402
                                                                                                                                                                                                                                            • SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00405426
                                                                                                                                                                                                                                            • SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00405446
                                                                                                                                                                                                                                            • ImageList_Destroy.COMCTL32(?), ref: 0040545B
                                                                                                                                                                                                                                            • GlobalFree.KERNEL32(?), ref: 0040546B
                                                                                                                                                                                                                                            • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 004054E4
                                                                                                                                                                                                                                            • SendMessageW.USER32(?,00001102,?,?), ref: 0040558D
                                                                                                                                                                                                                                            • SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 0040559C
                                                                                                                                                                                                                                            • InvalidateRect.USER32(?,00000000,00000001), ref: 004055C7
                                                                                                                                                                                                                                            • ShowWindow.USER32(?,00000000), ref: 00405615
                                                                                                                                                                                                                                            • GetDlgItem.USER32(?,000003FE), ref: 00405620
                                                                                                                                                                                                                                            • ShowWindow.USER32(00000000), ref: 00405627
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000009.00000002.2909503270.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909473554.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909531324.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nswC086.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: MessageSend$Window$Image$ItemList_LongShow$Global$AllocCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
                                                                                                                                                                                                                                            • String ID: $M$N
                                                                                                                                                                                                                                            • API String ID: 2564846305-813528018
                                                                                                                                                                                                                                            • Opcode ID: 950969970af6d10ef62121ad67a768569704eb6391eae900e1ce4f9d1827afee
                                                                                                                                                                                                                                            • Instruction ID: a1eb65f7683e17450fca8d4cb4c1055b074660be5b1b810df034ff690b7f681c
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 950969970af6d10ef62121ad67a768569704eb6391eae900e1ce4f9d1827afee
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 2A025CB0900609EFDF20DF65CD45AAE7BB5FB44315F10817AEA10BA2E1D7798A52CF18
                                                                                                                                                                                                                                            Function 004040C5 Relevance: 61.6, APIs: 34, Strings: 1, Instructions: 357windowstringCOMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00404101
                                                                                                                                                                                                                                            • ShowWindow.USER32(?), ref: 00404121
                                                                                                                                                                                                                                            • GetWindowLongW.USER32(?,000000F0), ref: 00404133
                                                                                                                                                                                                                                            • ShowWindow.USER32(?,00000004), ref: 0040414C
                                                                                                                                                                                                                                            • DestroyWindow.USER32 ref: 00404160
                                                                                                                                                                                                                                            • SetWindowLongW.USER32(?,00000000,00000000), ref: 00404179
                                                                                                                                                                                                                                            • GetDlgItem.USER32(?,?), ref: 00404198
                                                                                                                                                                                                                                            • SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 004041AC
                                                                                                                                                                                                                                            • IsWindowEnabled.USER32(00000000), ref: 004041B3
                                                                                                                                                                                                                                            • GetDlgItem.USER32(?,00000001), ref: 0040425E
                                                                                                                                                                                                                                            • GetDlgItem.USER32(?,00000002), ref: 00404268
                                                                                                                                                                                                                                            • SetClassLongW.USER32(?,000000F2,?), ref: 00404282
                                                                                                                                                                                                                                            • SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 004042D3
                                                                                                                                                                                                                                            • GetDlgItem.USER32(?,00000003), ref: 00404379
                                                                                                                                                                                                                                            • ShowWindow.USER32(00000000,?), ref: 0040439A
                                                                                                                                                                                                                                            • EnableWindow.USER32(?,?), ref: 004043AC
                                                                                                                                                                                                                                            • EnableWindow.USER32(?,?), ref: 004043C7
                                                                                                                                                                                                                                            • GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 004043DD
                                                                                                                                                                                                                                            • EnableMenuItem.USER32(00000000), ref: 004043E4
                                                                                                                                                                                                                                            • SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 004043FC
                                                                                                                                                                                                                                            • SendMessageW.USER32(?,00000401,00000002,00000000), ref: 0040440F
                                                                                                                                                                                                                                            • lstrlenW.KERNEL32(00423748,?,00423748,00000000), ref: 00404439
                                                                                                                                                                                                                                            • SetWindowTextW.USER32(?,00423748), ref: 0040444D
                                                                                                                                                                                                                                            • ShowWindow.USER32(?,0000000A), ref: 00404581
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000009.00000002.2909503270.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909473554.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909531324.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nswC086.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Window$Item$MessageSendShow$EnableLong$Menu$ClassDestroyEnabledSystemTextlstrlen
                                                                                                                                                                                                                                            • String ID: H7B
                                                                                                                                                                                                                                            • API String ID: 1860320154-2300413410
                                                                                                                                                                                                                                            • Opcode ID: 2f4dad2f818047668635e16f952da299a81014d83ff1599baf972819d0fbfd0c
                                                                                                                                                                                                                                            • Instruction ID: 1d4a55fced449df2e2a9dfc159c1061f424388fbea236c5341ec002980a30b6c
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 2f4dad2f818047668635e16f952da299a81014d83ff1599baf972819d0fbfd0c
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: C0C1C2B1600604FBDB216F61EE85E2A3B78EB85745F40097EF781B51F0CB3958529B2E
                                                                                                                                                                                                                                            Function 00404783 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 204windowstringCOMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • CheckDlgButton.USER32(?,-0000040A,00000001), ref: 00404821
                                                                                                                                                                                                                                            • GetDlgItem.USER32(?,000003E8), ref: 00404835
                                                                                                                                                                                                                                            • SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 00404852
                                                                                                                                                                                                                                            • GetSysColor.USER32(?), ref: 00404863
                                                                                                                                                                                                                                            • SendMessageW.USER32(00000000,00000443,00000000,?), ref: 00404871
                                                                                                                                                                                                                                            • SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 0040487F
                                                                                                                                                                                                                                            • lstrlenW.KERNEL32(?), ref: 00404884
                                                                                                                                                                                                                                            • SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 00404891
                                                                                                                                                                                                                                            • SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 004048A6
                                                                                                                                                                                                                                            • GetDlgItem.USER32(?,0000040A), ref: 004048FF
                                                                                                                                                                                                                                            • SendMessageW.USER32(00000000), ref: 00404906
                                                                                                                                                                                                                                            • GetDlgItem.USER32(?,000003E8), ref: 00404931
                                                                                                                                                                                                                                            • SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 00404974
                                                                                                                                                                                                                                            • LoadCursorW.USER32(00000000,00007F02), ref: 00404982
                                                                                                                                                                                                                                            • SetCursor.USER32(00000000), ref: 00404985
                                                                                                                                                                                                                                            • LoadCursorW.USER32(00000000,00007F00), ref: 0040499E
                                                                                                                                                                                                                                            • SetCursor.USER32(00000000), ref: 004049A1
                                                                                                                                                                                                                                            • SendMessageW.USER32(00000111,00000001,00000000), ref: 004049D0
                                                                                                                                                                                                                                            • SendMessageW.USER32(00000010,00000000,00000000), ref: 004049E2
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000009.00000002.2909503270.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909473554.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909531324.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nswC086.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
                                                                                                                                                                                                                                            • String ID: N$get
                                                                                                                                                                                                                                            • API String ID: 3103080414-214687294
                                                                                                                                                                                                                                            • Opcode ID: 7b7ce6e7f04c0852b245e81234b58653da2c4cab9b10fb98097c13f3cf17b06e
                                                                                                                                                                                                                                            • Instruction ID: 690b4d321b533a2a97605fa3f7bb2423a24794fe1ec6c961d913f822d5f12d1b
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 7b7ce6e7f04c0852b245e81234b58653da2c4cab9b10fb98097c13f3cf17b06e
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: AB6181F1900209FFDB109F61CD85A6A7B69FB84304F00813AF705B62E0C7799951DFA9
                                                                                                                                                                                                                                            Function 00404AB5 Relevance: 26.5, APIs: 10, Strings: 5, Instructions: 275stringCOMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • GetDlgItem.USER32(?,000003FB), ref: 00404B04
                                                                                                                                                                                                                                            • SetWindowTextW.USER32(00000000,?), ref: 00404B2E
                                                                                                                                                                                                                                            • SHBrowseForFolderW.SHELL32(?), ref: 00404BDF
                                                                                                                                                                                                                                            • CoTaskMemFree.OLE32(00000000), ref: 00404BEA
                                                                                                                                                                                                                                            • lstrcmpiW.KERNEL32(get,00423748,00000000,?,?), ref: 00404C1C
                                                                                                                                                                                                                                            • lstrcatW.KERNEL32(?,get), ref: 00404C28
                                                                                                                                                                                                                                            • SetDlgItemTextW.USER32(?,000003FB,?), ref: 00404C3A
                                                                                                                                                                                                                                              • Part of subcall function 00405CAC: GetDlgItemTextW.USER32(?,?,00000400,00404C71), ref: 00405CBF
                                                                                                                                                                                                                                              • Part of subcall function 004068EF: CharNextW.USER32(?,*?|<>/":,00000000,00000000,76233420,C:\Users\user\AppData\Local\Temp\,?,0040361B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00406952
                                                                                                                                                                                                                                              • Part of subcall function 004068EF: CharNextW.USER32(?,?,?,00000000,?,0040361B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00406961
                                                                                                                                                                                                                                              • Part of subcall function 004068EF: CharNextW.USER32(?,00000000,76233420,C:\Users\user\AppData\Local\Temp\,?,0040361B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00406966
                                                                                                                                                                                                                                              • Part of subcall function 004068EF: CharPrevW.USER32(?,?,76233420,C:\Users\user\AppData\Local\Temp\,?,0040361B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00406979
                                                                                                                                                                                                                                            • GetDiskFreeSpaceW.KERNEL32(00421718,?,?,0000040F,?,00421718,00421718,?,00000001,00421718,?,?,000003FB,?), ref: 00404CFD
                                                                                                                                                                                                                                            • MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404D18
                                                                                                                                                                                                                                              • Part of subcall function 00404E71: lstrlenW.KERNEL32(00423748,00423748,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404F12
                                                                                                                                                                                                                                              • Part of subcall function 00404E71: wsprintfW.USER32 ref: 00404F1B
                                                                                                                                                                                                                                              • Part of subcall function 00404E71: SetDlgItemTextW.USER32(?,00423748), ref: 00404F2E
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000009.00000002.2909503270.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909473554.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909531324.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nswC086.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
                                                                                                                                                                                                                                            • String ID: 6529687$A$C:\Users\user\PCAppStore$H7B$get
                                                                                                                                                                                                                                            • API String ID: 2624150263-4289152731
                                                                                                                                                                                                                                            • Opcode ID: 667bbe0a30595837a03e9c6ce466c2f6c83f7bc5ead90454ae6c6de6e9a81711
                                                                                                                                                                                                                                            • Instruction ID: 9155a42c54a3203d4d9709c494e168d8d926bd307d67cbb08bf4d9f42020e7e3
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 667bbe0a30595837a03e9c6ce466c2f6c83f7bc5ead90454ae6c6de6e9a81711
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 94A171F1900219ABDB11EFA5CD41AAFB7B8EF84315F11843BF601B62D1D77C8A418B69
                                                                                                                                                                                                                                            Function 004062AE Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 130memorystringCOMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,?,00406449,?,?), ref: 004062E9
                                                                                                                                                                                                                                            • GetShortPathNameW.KERNEL32(?,00426DE8,00000400), ref: 004062F2
                                                                                                                                                                                                                                              • Part of subcall function 004060BD: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,004063A2,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004060CD
                                                                                                                                                                                                                                              • Part of subcall function 004060BD: lstrlenA.KERNEL32(00000000,?,00000000,004063A2,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004060FF
                                                                                                                                                                                                                                            • GetShortPathNameW.KERNEL32(?,004275E8,00000400), ref: 0040630F
                                                                                                                                                                                                                                            • wsprintfA.USER32 ref: 0040632D
                                                                                                                                                                                                                                            • GetFileSize.KERNEL32(00000000,00000000,004275E8,C0000000,00000004,004275E8,?,?,?,?,?), ref: 00406368
                                                                                                                                                                                                                                            • GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00406377
                                                                                                                                                                                                                                            • lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004063AF
                                                                                                                                                                                                                                            • SetFilePointer.KERNEL32(0040A5B0,00000000,00000000,00000000,00000000,004269E8,00000000,-0000000A,0040A5B0,00000000,[Rename],00000000,00000000,00000000), ref: 00406405
                                                                                                                                                                                                                                            • GlobalFree.KERNEL32(00000000), ref: 00406416
                                                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 0040641D
                                                                                                                                                                                                                                              • Part of subcall function 00406158: GetFileAttributesW.KERNEL32(00000003,00403113,C:\Users\user\AppData\Local\Temp\nswC086.tmp,80000000,00000003), ref: 0040615C
                                                                                                                                                                                                                                              • Part of subcall function 00406158: CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000), ref: 0040617E
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000009.00000002.2909503270.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909473554.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909531324.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nswC086.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
                                                                                                                                                                                                                                            • String ID: %ls=%ls$[Rename]$mB$uB$uB
                                                                                                                                                                                                                                            • API String ID: 2171350718-2295842750
                                                                                                                                                                                                                                            • Opcode ID: 07ea5d3dd502240bf86d0c298f94c43ad2335bec49c481c59c36197298e6ebad
                                                                                                                                                                                                                                            • Instruction ID: df9b4e9fb9d32bd4c250032a1d399944af7a2e4c2f0bdec2b7d3959d12e60cc8
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 07ea5d3dd502240bf86d0c298f94c43ad2335bec49c481c59c36197298e6ebad
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: B8314331200315BBD2206B619D49F5B3AACEF85704F16003BFD02FA2C2EA7DD82186BD
                                                                                                                                                                                                                                            Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
                                                                                                                                                                                                                                            • BeginPaint.USER32(?,?), ref: 00401047
                                                                                                                                                                                                                                            • GetClientRect.USER32(?,?), ref: 0040105B
                                                                                                                                                                                                                                            • CreateBrushIndirect.GDI32(00000000), ref: 004010CF
                                                                                                                                                                                                                                            • FillRect.USER32(00000000,?,00000000), ref: 004010E4
                                                                                                                                                                                                                                            • DeleteObject.GDI32(?), ref: 004010ED
                                                                                                                                                                                                                                            • CreateFontIndirectW.GDI32(?), ref: 00401105
                                                                                                                                                                                                                                            • SetBkMode.GDI32(00000000,00000001), ref: 00401126
                                                                                                                                                                                                                                            • SetTextColor.GDI32(00000000,000000FF), ref: 00401130
                                                                                                                                                                                                                                            • SelectObject.GDI32(00000000,?), ref: 00401140
                                                                                                                                                                                                                                            • DrawTextW.USER32(00000000,00429260,000000FF,00000010,00000820), ref: 00401156
                                                                                                                                                                                                                                            • SelectObject.GDI32(00000000,00000000), ref: 00401160
                                                                                                                                                                                                                                            • DeleteObject.GDI32(?), ref: 00401165
                                                                                                                                                                                                                                            • EndPaint.USER32(?,?), ref: 0040116E
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000009.00000002.2909503270.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909473554.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909531324.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nswC086.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
                                                                                                                                                                                                                                            • String ID: F
                                                                                                                                                                                                                                            • API String ID: 941294808-1304234792
                                                                                                                                                                                                                                            • Opcode ID: 8da9fae8b34351ceae2931000ebd9f39a308799c7d87b7a6dbcfe72b45b7384c
                                                                                                                                                                                                                                            • Instruction ID: e2f9fea5dfd6f059ba8eeb08e8d10ac227d01a2162b8a260283931f50cd0bfbf
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 8da9fae8b34351ceae2931000ebd9f39a308799c7d87b7a6dbcfe72b45b7384c
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 33418B71800209EFCF058FA5DE459AF7BB9FF45315F00802AF991AA2A0C7349A55DFA4
                                                                                                                                                                                                                                            Function 004056CA Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 72stringwindowCOMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • lstrlenW.KERNEL32(00422728,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000,?), ref: 00405702
                                                                                                                                                                                                                                            • lstrlenW.KERNEL32(004030A8,00422728,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000), ref: 00405712
                                                                                                                                                                                                                                            • lstrcatW.KERNEL32(00422728,004030A8,004030A8,00422728,00000000,00000000,00000000), ref: 00405725
                                                                                                                                                                                                                                            • SetWindowTextW.USER32(00422728,00422728), ref: 00405737
                                                                                                                                                                                                                                            • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040575D
                                                                                                                                                                                                                                            • SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405777
                                                                                                                                                                                                                                            • SendMessageW.USER32(?,00001013,?,00000000), ref: 00405785
                                                                                                                                                                                                                                              • Part of subcall function 004066A5: lstrcatW.KERNEL32(get,\Microsoft\Internet Explorer\Quick Launch), ref: 0040684A
                                                                                                                                                                                                                                              • Part of subcall function 004066A5: lstrlenW.KERNEL32(get,00000000,00422728,?,00405701,00422728,00000000), ref: 004068A4
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000009.00000002.2909503270.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909473554.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909531324.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nswC086.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: MessageSendlstrlen$lstrcat$TextWindow
                                                                                                                                                                                                                                            • String ID: ('B
                                                                                                                                                                                                                                            • API String ID: 1495540970-2332581011
                                                                                                                                                                                                                                            • Opcode ID: da0887550f177a20a5adca650a80eb3065253b4758cf57a6ba66e38fd01475e6
                                                                                                                                                                                                                                            • Instruction ID: 7f52a71d89202be05388d2ae90ba5930d13dcc1e6093ad3ff4eaa481a322a782
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: da0887550f177a20a5adca650a80eb3065253b4758cf57a6ba66e38fd01475e6
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: C6217A71900518FACB119FA5DD84A8EBFB8EB45360F10857AF904B62A0D67A4A509F68
                                                                                                                                                                                                                                            Function 0040462B Relevance: 12.1, APIs: 8, Instructions: 68COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • GetWindowLongW.USER32(?,000000EB), ref: 00404648
                                                                                                                                                                                                                                            • GetSysColor.USER32(00000000), ref: 00404686
                                                                                                                                                                                                                                            • SetTextColor.GDI32(?,00000000), ref: 00404692
                                                                                                                                                                                                                                            • SetBkMode.GDI32(?,?), ref: 0040469E
                                                                                                                                                                                                                                            • GetSysColor.USER32(?), ref: 004046B1
                                                                                                                                                                                                                                            • SetBkColor.GDI32(?,?), ref: 004046C1
                                                                                                                                                                                                                                            • DeleteObject.GDI32(?), ref: 004046DB
                                                                                                                                                                                                                                            • CreateBrushIndirect.GDI32(?), ref: 004046E5
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000009.00000002.2909503270.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909473554.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909531324.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nswC086.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 2320649405-0
                                                                                                                                                                                                                                            • Opcode ID: f4fe220c79686689299554ac50abea47664d32920eac269e7a43003585d3568b
                                                                                                                                                                                                                                            • Instruction ID: e78b8cc9c8042372c9a7340b9b8aa9b23ded286a9f8ddc7240a2e2d8bd1f46c0
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: f4fe220c79686689299554ac50abea47664d32920eac269e7a43003585d3568b
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: DE2197715007049FC7309F28D908B5BBBF8AF42714F008D2EE992A22E1D739D944DB58
                                                                                                                                                                                                                                            Function 004026EC Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153fileCOMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • ReadFile.KERNEL32(?,?,?,?), ref: 00402758
                                                                                                                                                                                                                                            • MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 00402793
                                                                                                                                                                                                                                            • SetFilePointer.KERNEL32(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 004027B6
                                                                                                                                                                                                                                            • MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 004027CC
                                                                                                                                                                                                                                              • Part of subcall function 00406239: SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 0040624F
                                                                                                                                                                                                                                            • SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 00402878
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000009.00000002.2909503270.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909473554.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909531324.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nswC086.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: File$Pointer$ByteCharMultiWide$Read
                                                                                                                                                                                                                                            • String ID: 9
                                                                                                                                                                                                                                            • API String ID: 163830602-2366072709
                                                                                                                                                                                                                                            • Opcode ID: c494a9c5f1831dca55446a6dfc25bb45b63b896379fbbdb0ec38153142a3ac1c
                                                                                                                                                                                                                                            • Instruction ID: 581cf2785626502de532f206a1de9da9d9b8d20bcd24121b7f7bd1133decb9a2
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: c494a9c5f1831dca55446a6dfc25bb45b63b896379fbbdb0ec38153142a3ac1c
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: CE51FB75D00219AADF20EF95CA88AAEBB75FF04304F50417BE541B62D4D7B49D82CB58
                                                                                                                                                                                                                                            Function 004068EF Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 69COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • CharNextW.USER32(?,*?|<>/":,00000000,00000000,76233420,C:\Users\user\AppData\Local\Temp\,?,0040361B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00406952
                                                                                                                                                                                                                                            • CharNextW.USER32(?,?,?,00000000,?,0040361B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00406961
                                                                                                                                                                                                                                            • CharNextW.USER32(?,00000000,76233420,C:\Users\user\AppData\Local\Temp\,?,0040361B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00406966
                                                                                                                                                                                                                                            • CharPrevW.USER32(?,?,76233420,C:\Users\user\AppData\Local\Temp\,?,0040361B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00406979
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000009.00000002.2909503270.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909473554.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909531324.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nswC086.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Char$Next$Prev
                                                                                                                                                                                                                                            • String ID: *?|<>/":$C:\Users\user\AppData\Local\Temp\
                                                                                                                                                                                                                                            • API String ID: 589700163-826357637
                                                                                                                                                                                                                                            • Opcode ID: 4a25a2118415850d7bb15acf585ec7f7b5de772317bec8c7d00468289de3f440
                                                                                                                                                                                                                                            • Instruction ID: d28fb8c2eefe6f61a155ceb01790bbf8b21f4710aa7989e54d8eeb8481a577c9
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 4a25a2118415850d7bb15acf585ec7f7b5de772317bec8c7d00468289de3f440
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 2611089580061295DB303B18CC40BB762F8AF99B50F12403FE98A776C1E77C4C9286BD
                                                                                                                                                                                                                                            Function 0040302E Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • DestroyWindow.USER32(00000000,00000000), ref: 00403049
                                                                                                                                                                                                                                            • GetTickCount.KERNEL32 ref: 00403067
                                                                                                                                                                                                                                            • wsprintfW.USER32 ref: 00403095
                                                                                                                                                                                                                                              • Part of subcall function 004056CA: lstrlenW.KERNEL32(00422728,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000,?), ref: 00405702
                                                                                                                                                                                                                                              • Part of subcall function 004056CA: lstrlenW.KERNEL32(004030A8,00422728,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000), ref: 00405712
                                                                                                                                                                                                                                              • Part of subcall function 004056CA: lstrcatW.KERNEL32(00422728,004030A8,004030A8,00422728,00000000,00000000,00000000), ref: 00405725
                                                                                                                                                                                                                                              • Part of subcall function 004056CA: SetWindowTextW.USER32(00422728,00422728), ref: 00405737
                                                                                                                                                                                                                                              • Part of subcall function 004056CA: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040575D
                                                                                                                                                                                                                                              • Part of subcall function 004056CA: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405777
                                                                                                                                                                                                                                              • Part of subcall function 004056CA: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405785
                                                                                                                                                                                                                                            • CreateDialogParamW.USER32(0000006F,00000000,00402F93,00000000), ref: 004030B9
                                                                                                                                                                                                                                            • ShowWindow.USER32(00000000,00000005), ref: 004030C7
                                                                                                                                                                                                                                              • Part of subcall function 00403012: MulDiv.KERNEL32(00000000,00000064,00015C8B), ref: 00403027
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000009.00000002.2909503270.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909473554.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909531324.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nswC086.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: MessageSendWindow$lstrlen$CountCreateDestroyDialogParamShowTextTicklstrcatwsprintf
                                                                                                                                                                                                                                            • String ID: ... %d%%
                                                                                                                                                                                                                                            • API String ID: 722711167-2449383134
                                                                                                                                                                                                                                            • Opcode ID: a65563718f57099a27635650194dd277da09fbe66beefc8d93bb4be83c5e7891
                                                                                                                                                                                                                                            • Instruction ID: 5af6bf9b0b70cf9307c1258d0e5a667b07be53d22b58a3258066d7aee54b172b
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: a65563718f57099a27635650194dd277da09fbe66beefc8d93bb4be83c5e7891
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: E8018E70553614DBC7317F60AE08A5A3EACAB00F06F54457AF841B21E9DAB84645CBAE
                                                                                                                                                                                                                                            Function 00404F7F Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404F9A
                                                                                                                                                                                                                                            • GetMessagePos.USER32 ref: 00404FA2
                                                                                                                                                                                                                                            • ScreenToClient.USER32(?,?), ref: 00404FBC
                                                                                                                                                                                                                                            • SendMessageW.USER32(?,00001111,00000000,?), ref: 00404FCE
                                                                                                                                                                                                                                            • SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404FF4
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000009.00000002.2909503270.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909473554.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909531324.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nswC086.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Message$Send$ClientScreen
                                                                                                                                                                                                                                            • String ID: f
                                                                                                                                                                                                                                            • API String ID: 41195575-1993550816
                                                                                                                                                                                                                                            • Opcode ID: b2affdf3b53bee8738e3b61904ea6c87bda347b462d3853a737802ef9deed65a
                                                                                                                                                                                                                                            • Instruction ID: ce4c7d6d39dceca23aa6ebdb29af7737867007859e7bede0b388bd4d525dd41f
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: b2affdf3b53bee8738e3b61904ea6c87bda347b462d3853a737802ef9deed65a
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 3C014C71940219BADB00DBA4DD85BFEBBB8AF54711F10012BBB50B61C0D6B49A058BA5
                                                                                                                                                                                                                                            Function 00402F93 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36timeCOMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402FB1
                                                                                                                                                                                                                                            • wsprintfW.USER32 ref: 00402FE5
                                                                                                                                                                                                                                            • SetWindowTextW.USER32(?,?), ref: 00402FF5
                                                                                                                                                                                                                                            • SetDlgItemTextW.USER32(?,00000406,?), ref: 00403007
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000009.00000002.2909503270.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909473554.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909531324.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nswC086.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Text$ItemTimerWindowwsprintf
                                                                                                                                                                                                                                            • String ID: unpacking data: %d%%$verifying installer: %d%%
                                                                                                                                                                                                                                            • API String ID: 1451636040-1158693248
                                                                                                                                                                                                                                            • Opcode ID: b65fa6b26e28fa793ab4966251e07a6fe500b79f9b1e2f9c66e5bc42e84335f7
                                                                                                                                                                                                                                            • Instruction ID: 34ad84b97f90b05cf42cbebec4ee1aaae98efe268bf46a139428006d78f28757
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: b65fa6b26e28fa793ab4966251e07a6fe500b79f9b1e2f9c66e5bc42e84335f7
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 25F0497050020DABEF246F60DD49BEA3B69FB00309F00803AFA05B51D0DFBD9A559F59
                                                                                                                                                                                                                                            Function 00404E71 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 84stringCOMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • lstrlenW.KERNEL32(00423748,00423748,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404F12
                                                                                                                                                                                                                                            • wsprintfW.USER32 ref: 00404F1B
                                                                                                                                                                                                                                            • SetDlgItemTextW.USER32(?,00423748), ref: 00404F2E
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000009.00000002.2909503270.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909473554.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909531324.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nswC086.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: ItemTextlstrlenwsprintf
                                                                                                                                                                                                                                            • String ID: %u.%u%s%s$H7B
                                                                                                                                                                                                                                            • API String ID: 3540041739-107966168
                                                                                                                                                                                                                                            • Opcode ID: 2edccdcb36c72f9bdce7a586f7ca7ee262dfb9f9a49697097ea36a1117f17e36
                                                                                                                                                                                                                                            • Instruction ID: 20619224473e8c08b4fba53027c62ddcf1c3fef784a2ba69f514aa474de30786
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 2edccdcb36c72f9bdce7a586f7ca7ee262dfb9f9a49697097ea36a1117f17e36
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 1A11D8736041283BDB00A5ADDC45E9F3298AB81338F150637FA26F61D1EA79882182E8
                                                                                                                                                                                                                                            Function 00402EA9 Relevance: 7.6, APIs: 5, Instructions: 84registryCOMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • RegEnumValueW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,?,00100020,?,?,?), ref: 00402EFD
                                                                                                                                                                                                                                            • RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402F49
                                                                                                                                                                                                                                            • RegCloseKey.ADVAPI32(?,?,?), ref: 00402F52
                                                                                                                                                                                                                                            • RegDeleteKeyW.ADVAPI32(?,?), ref: 00402F69
                                                                                                                                                                                                                                            • RegCloseKey.ADVAPI32(?,?,?), ref: 00402F74
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000009.00000002.2909503270.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909473554.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909531324.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nswC086.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: CloseEnum$DeleteValue
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 1354259210-0
                                                                                                                                                                                                                                            • Opcode ID: 953796069c20d6fa7490a0bfa1861ca0c616837e62ffc418281f2642f3cef6d6
                                                                                                                                                                                                                                            • Instruction ID: 37c7ba0f9c491dd7f389852fcb35a119484072d927876f68e32cbd91f0a54eef
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 953796069c20d6fa7490a0bfa1861ca0c616837e62ffc418281f2642f3cef6d6
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 6D216B7150010ABBDF11AF94CE89EEF7B7DEB50384F110076F909B21E0D7B49E54AA68
                                                                                                                                                                                                                                            Function 00401D81 Relevance: 7.6, APIs: 5, Instructions: 75windowCOMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • GetDlgItem.USER32(?,?), ref: 00401D9A
                                                                                                                                                                                                                                            • GetClientRect.USER32(?,?), ref: 00401DE5
                                                                                                                                                                                                                                            • LoadImageW.USER32(?,?,?,?,?,?), ref: 00401E15
                                                                                                                                                                                                                                            • SendMessageW.USER32(?,00000172,?,00000000), ref: 00401E29
                                                                                                                                                                                                                                            • DeleteObject.GDI32(00000000), ref: 00401E39
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000009.00000002.2909503270.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909473554.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909531324.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nswC086.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: ClientDeleteImageItemLoadMessageObjectRectSend
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 1849352358-0
                                                                                                                                                                                                                                            • Opcode ID: 100b3177012869429c2005611ce111630833f28d1ab152a2d5a2575cfc39775b
                                                                                                                                                                                                                                            • Instruction ID: 4d725fdcf847a80329c23b38d7164c003567f542edd6fcacfb34c9ebeef40da9
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 100b3177012869429c2005611ce111630833f28d1ab152a2d5a2575cfc39775b
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 67212672904119AFCB05CBA4DE45AEEBBB5EF08304F14003AF945F62A0CB389951DB98
                                                                                                                                                                                                                                            Function 00401E4E Relevance: 7.5, APIs: 5, Instructions: 43COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • GetDC.USER32(?), ref: 00401E51
                                                                                                                                                                                                                                            • GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401E6B
                                                                                                                                                                                                                                            • MulDiv.KERNEL32(00000000,00000000), ref: 00401E73
                                                                                                                                                                                                                                            • ReleaseDC.USER32(?,00000000), ref: 00401E84
                                                                                                                                                                                                                                              • Part of subcall function 004066A5: lstrcatW.KERNEL32(get,\Microsoft\Internet Explorer\Quick Launch), ref: 0040684A
                                                                                                                                                                                                                                              • Part of subcall function 004066A5: lstrlenW.KERNEL32(get,00000000,00422728,?,00405701,00422728,00000000), ref: 004068A4
                                                                                                                                                                                                                                            • CreateFontIndirectW.GDI32(0040CDF8), ref: 00401ED3
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000009.00000002.2909503270.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909473554.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909531324.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nswC086.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: CapsCreateDeviceFontIndirectReleaselstrcatlstrlen
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 2584051700-0
                                                                                                                                                                                                                                            • Opcode ID: e128970cf71a0b284ce18b21917758e509e5717976d06807f88455f58f814df6
                                                                                                                                                                                                                                            • Instruction ID: b9cc094806d22c325402cb6ccb5f5134c2025175c414775df3ff87de861ccae2
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: e128970cf71a0b284ce18b21917758e509e5717976d06807f88455f58f814df6
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 8401B571900241EFEB005BB4EE89A9A3FB0AB15301F208939F541B71D2C6B904459BED
                                                                                                                                                                                                                                            Function 00401C43 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401CB3
                                                                                                                                                                                                                                            • SendMessageW.USER32(00000000,00000000,?,?), ref: 00401CCB
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000009.00000002.2909503270.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909473554.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909531324.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nswC086.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: MessageSend$Timeout
                                                                                                                                                                                                                                            • String ID: !
                                                                                                                                                                                                                                            • API String ID: 1777923405-2657877971
                                                                                                                                                                                                                                            • Opcode ID: b183ccb6ab3284ced798d12f720e161a9248df31e23c89b80f307d5b894ef539
                                                                                                                                                                                                                                            • Instruction ID: e1c20d37316975b9b94706f7b3abd8da4b7b3b5136eece5bd2aa3cbae88a6c19
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: b183ccb6ab3284ced798d12f720e161a9248df31e23c89b80f307d5b894ef539
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 28219E7190420AEFEF05AFA4D94AAAE7BB4FF44304F14453EF601B61D0D7B88941CB98
                                                                                                                                                                                                                                            Function 00406536 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 44registryCOMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • RegQueryValueExW.ADVAPI32(?,?,00000000,?,?,0040A230,00000000,('B,00000000,?,?,get,?,?,0040679D,80000002), ref: 0040657C
                                                                                                                                                                                                                                            • RegCloseKey.ADVAPI32(?,?,0040679D,80000002,Software\Microsoft\Windows\CurrentVersion,get,get,get,00000000,00422728), ref: 00406587
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000009.00000002.2909503270.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909473554.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909531324.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nswC086.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: CloseQueryValue
                                                                                                                                                                                                                                            • String ID: ('B$get
                                                                                                                                                                                                                                            • API String ID: 3356406503-1955485993
                                                                                                                                                                                                                                            • Opcode ID: abb8e2472c70d4d58aecb7d0dfcf889930bd109b5a1b9baac0574de2233c5019
                                                                                                                                                                                                                                            • Instruction ID: 52dd0fe420a7c1e2827d1a164217834099ee72e945ce70567094b216899e5676
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: abb8e2472c70d4d58aecb7d0dfcf889930bd109b5a1b9baac0574de2233c5019
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: C4017C72500209FADF21CF51DD09EDB3BA8EF54364F01803AFD1AA2190D738D964DBA4
                                                                                                                                                                                                                                            Function 00405F37 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • lstrlenW.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,0040362D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00405F3D
                                                                                                                                                                                                                                            • CharPrevW.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,0040362D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00405F47
                                                                                                                                                                                                                                            • lstrcatW.KERNEL32(?,0040A014), ref: 00405F59
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            • C:\Users\user\AppData\Local\Temp\, xrefs: 00405F37
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000009.00000002.2909503270.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909473554.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909531324.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nswC086.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: CharPrevlstrcatlstrlen
                                                                                                                                                                                                                                            • String ID: C:\Users\user\AppData\Local\Temp\
                                                                                                                                                                                                                                            • API String ID: 2659869361-3936084776
                                                                                                                                                                                                                                            • Opcode ID: 7317fb0b60a0da6156192e69c80d181f5022b3d5f83b8f009beaa75eacd33bdb
                                                                                                                                                                                                                                            • Instruction ID: 9007417a49851ea4d61da9c71e51c63d156abd36d345156a737e00ee84923012
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 7317fb0b60a0da6156192e69c80d181f5022b3d5f83b8f009beaa75eacd33bdb
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 59D05E611019246AC111AB548D04DDB63ACAE85304742046AF601B60A0CB7E196287ED
                                                                                                                                                                                                                                            Function 0040263E Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 65stringCOMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nscF90.tmp\inetc.dll), ref: 00402695
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000009.00000002.2909503270.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909473554.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909531324.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nswC086.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: lstrlen
                                                                                                                                                                                                                                            • String ID: C:\Users\user\AppData\Local\Temp\nscF90.tmp$C:\Users\user\AppData\Local\Temp\nscF90.tmp\inetc.dll
                                                                                                                                                                                                                                            • API String ID: 1659193697-1898264495
                                                                                                                                                                                                                                            • Opcode ID: 9a86cc41fb3ba1d07c106fca7ec167276fc7dee72b5d11bed2732143b2a4cd05
                                                                                                                                                                                                                                            • Instruction ID: f1e3379d491753f9d96dc3c217618d2e64da59e9cc8309568291ba5d2d488428
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 9a86cc41fb3ba1d07c106fca7ec167276fc7dee72b5d11bed2732143b2a4cd05
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: D511C472A00205EBCB10BBB18E4AA9E76619F44758F21483FE402B61C1DAFD8891965F
                                                                                                                                                                                                                                            Function 0040563E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • IsWindowVisible.USER32(?), ref: 0040566D
                                                                                                                                                                                                                                            • CallWindowProcW.USER32(?,?,?,?), ref: 004056BE
                                                                                                                                                                                                                                              • Part of subcall function 00404610: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 00404622
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000009.00000002.2909503270.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909473554.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909531324.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nswC086.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Window$CallMessageProcSendVisible
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 3748168415-3916222277
                                                                                                                                                                                                                                            • Opcode ID: a73dc4e993bde12ea44745026bd4b5676165c6f206d332bc9731ab0fc1b08652
                                                                                                                                                                                                                                            • Instruction ID: 537e1cae7e4c88fb21f4f8cfd237bdd46b0b38e99f2a5e053ca6ba0093d9a5c8
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: a73dc4e993bde12ea44745026bd4b5676165c6f206d332bc9731ab0fc1b08652
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 4401B171200608AFEF205F11DD84A6B3A35EB84361F904837FA08752E0D77F8D929E6D
                                                                                                                                                                                                                                            Function 00405F83 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • lstrlenW.KERNEL32(80000000,C:\Users\user\AppData\Local\Temp,0040313C,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp\nswC086.tmp,C:\Users\user\AppData\Local\Temp\nswC086.tmp,80000000,00000003), ref: 00405F89
                                                                                                                                                                                                                                            • CharPrevW.USER32(80000000,00000000,80000000,C:\Users\user\AppData\Local\Temp,0040313C,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp\nswC086.tmp,C:\Users\user\AppData\Local\Temp\nswC086.tmp,80000000,00000003), ref: 00405F99
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            • C:\Users\user\AppData\Local\Temp, xrefs: 00405F83
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000009.00000002.2909503270.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909473554.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909531324.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nswC086.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: CharPrevlstrlen
                                                                                                                                                                                                                                            • String ID: C:\Users\user\AppData\Local\Temp
                                                                                                                                                                                                                                            • API String ID: 2709904686-1104044542
                                                                                                                                                                                                                                            • Opcode ID: 176def5b2db9ef34a9f22db2929791273b03e08e07d7b66f37effa829582f156
                                                                                                                                                                                                                                            • Instruction ID: bd974b3f77e4b05eb9372a1ad14375fba7b947cfa10dd8d614d5bb7090e452f7
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 176def5b2db9ef34a9f22db2929791273b03e08e07d7b66f37effa829582f156
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 6CD05EB2401D219EC3126B04DC00D9F63ACEF51301B4A4866E441AB1A0DB7C5D9186A9
                                                                                                                                                                                                                                            Function 004060BD Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,004063A2,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004060CD
                                                                                                                                                                                                                                            • lstrcmpiA.KERNEL32(00000000,00000000), ref: 004060E5
                                                                                                                                                                                                                                            • CharNextA.USER32(00000000,?,00000000,004063A2,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004060F6
                                                                                                                                                                                                                                            • lstrlenA.KERNEL32(00000000,?,00000000,004063A2,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004060FF
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 00000009.00000002.2909503270.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909473554.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909531324.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2909567666.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 00000009.00000002.2910239451.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nswC086.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: lstrlen$CharNextlstrcmpi
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 190613189-0
                                                                                                                                                                                                                                            • Opcode ID: 4f145c51a58837bd7eda372618efc6ab74ada67201017ca859b4805a40dfc06b
                                                                                                                                                                                                                                            • Instruction ID: 2f06b96f93541eceebcae48a9adfe7aedd37cb678349478f8cad11de2473fd3e
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 4f145c51a58837bd7eda372618efc6ab74ada67201017ca859b4805a40dfc06b
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 0BF0F631104054FFDB12DFA4CD00D9EBBA8EF06350B2640BAE841FB321D674DE11A798

                                                                                                                                                                                                                                            Execution Graph

                                                                                                                                                                                                                                            Execution Coverage:15.5%
                                                                                                                                                                                                                                            Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                                                                            Signature Coverage:0.7%
                                                                                                                                                                                                                                            Total number of Nodes:2000
                                                                                                                                                                                                                                            Total number of Limit Nodes:69
                                                                                                                                                                                                                                            execution_graph 73002 7ff72f9c1080 73007 7ff72fba5a90 73002->73007 73153 7ff72f9d11a0 73007->73153 73012 7ff72f9d11a0 _Mpunct 51 API calls 73013 7ff72fba5b0c 73012->73013 73014 7ff72fa198a0 70 API calls 73013->73014 73015 7ff72fba5b29 73014->73015 73016 7ff72f9d11a0 _Mpunct 51 API calls 73015->73016 73017 7ff72fba5b4e 73016->73017 73018 7ff72fa198a0 70 API calls 73017->73018 73019 7ff72fba5b6b 73018->73019 73020 7ff72f9d11a0 _Mpunct 51 API calls 73019->73020 73021 7ff72fba5b90 73020->73021 73022 7ff72fa198a0 70 API calls 73021->73022 73023 7ff72fba5bad 73022->73023 73024 7ff72f9d11a0 _Mpunct 51 API calls 73023->73024 73025 7ff72fba5bd2 73024->73025 73026 7ff72fa198a0 70 API calls 73025->73026 73027 7ff72fba5bef 73026->73027 73028 7ff72f9d11a0 _Mpunct 51 API calls 73027->73028 73029 7ff72fba5c14 73028->73029 73030 7ff72fa198a0 70 API calls 73029->73030 73031 7ff72fba5c31 73030->73031 73032 7ff72f9d11a0 _Mpunct 51 API calls 73031->73032 73033 7ff72fba5c56 73032->73033 73034 7ff72fa198a0 70 API calls 73033->73034 73035 7ff72fba5c73 73034->73035 73036 7ff72f9d11a0 _Mpunct 51 API calls 73035->73036 73037 7ff72fba5c98 73036->73037 73038 7ff72fa198a0 70 API calls 73037->73038 73039 7ff72fba5cb5 73038->73039 73040 7ff72f9d11a0 _Mpunct 51 API calls 73039->73040 73041 7ff72fba5cda 73040->73041 73042 7ff72fa198a0 70 API calls 73041->73042 73043 7ff72fba5cf7 73042->73043 73044 7ff72f9d11a0 _Mpunct 51 API calls 73043->73044 73045 7ff72fba5d1c 73044->73045 73046 7ff72fa198a0 70 API calls 73045->73046 73047 7ff72fba5d39 73046->73047 73048 7ff72f9d11a0 _Mpunct 51 API calls 73047->73048 73049 7ff72fba5d5e 73048->73049 73050 7ff72fa198a0 70 API calls 73049->73050 73051 7ff72fba5d7b 73050->73051 73052 7ff72f9d11a0 _Mpunct 51 API calls 73051->73052 73053 7ff72fba5da0 73052->73053 73054 7ff72fa198a0 70 API calls 73053->73054 73055 7ff72fba5dbd 73054->73055 73056 7ff72f9d11a0 _Mpunct 51 API calls 73055->73056 73057 7ff72fba5de2 73056->73057 73058 7ff72fa198a0 70 API calls 73057->73058 73059 7ff72fba5dfc 73058->73059 73060 7ff72f9d11a0 _Mpunct 51 API calls 73059->73060 73061 7ff72fba5e21 73060->73061 73062 7ff72fa198a0 70 API calls 73061->73062 73063 7ff72fba5e3b 73062->73063 73064 7ff72f9d11a0 _Mpunct 51 API calls 73063->73064 73065 7ff72fba5e60 73064->73065 73066 7ff72fa198a0 70 API calls 73065->73066 73067 7ff72fba5e7a 73066->73067 73154 7ff72f9d11c7 _Mpunct _WChar_traits shared_ptr 73153->73154 73190 7ff72f9cb440 73154->73190 73156 7ff72f9d11ec 73157 7ff72fa198a0 73156->73157 73158 7ff72f9d11a0 _Mpunct 51 API calls 73157->73158 73159 7ff72fa198cd 73158->73159 73198 7ff72fa18170 73159->73198 73169 7ff72fa19943 Concurrency::details::WorkQueue::IsStructuredEmpty Concurrency::details::HardwareAffinity::operator!= 73220 7ff72fa189d0 73169->73220 73171 7ff72fa1997b shared_ptr 73172 7ff72fa19a29 Concurrency::details::WorkQueue::IsStructuredEmpty 73171->73172 73245 7ff72fa18200 47 API calls 73171->73245 73246 7ff72fa19cd0 51 API calls 2 library calls 73171->73246 73233 7ff72f9d04b0 73172->73233 73178 7ff72fa19a58 73179 7ff72f9d3c10 shared_ptr 47 API calls 73178->73179 73180 7ff72fa19a66 73179->73180 73181 7ff72f9d3c10 shared_ptr 47 API calls 73180->73181 73182 7ff72fa19a74 73181->73182 73183 7ff72f9d3c10 shared_ptr 47 API calls 73182->73183 73184 7ff72fa19a82 73183->73184 73184->73012 73191 7ff72f9cb467 _Mpunct 73190->73191 73193 7ff72f9cb473 Concurrency::details::WorkQueue::IsStructuredEmpty _Mpunct 73191->73193 73196 7ff72f9e2970 51 API calls Concurrency::task_continuation_context::task_continuation_context 73191->73196 73195 7ff72f9cb4ac _Mpunct Concurrency::task_continuation_context::task_continuation_context type_info::_name_internal_method shared_ptr char_traits 73193->73195 73197 7ff72f9caff0 49 API calls _Mpunct 73193->73197 73195->73156 73196->73193 73197->73195 73204 7ff72fa1818f 73198->73204 73199 7ff72fa181c7 73201 7ff72f9d3c10 shared_ptr 47 API calls 73199->73201 73203 7ff72fa181eb 73201->73203 73205 7ff72fa185c0 73203->73205 73204->73199 73247 7ff72fa18200 47 API calls 73204->73247 73248 7ff72fa06690 51 API calls 73204->73248 73206 7ff72fa185e9 Concurrency::details::WorkQueue::IsStructuredEmpty 73205->73206 73249 7ff72f9e2d10 73206->73249 73208 7ff72fa18602 73209 7ff72fa19e60 73208->73209 73254 7ff72f9d10b0 73209->73254 73211 7ff72f9d3c10 shared_ptr 47 API calls 73213 7ff72fa19914 73211->73213 73212 7ff72fa19e90 Concurrency::details::HardwareAffinity::operator!= 73212->73211 73214 7ff72fa18140 73213->73214 73215 7ff72fa185c0 type_info::_name_internal_method 51 API calls 73214->73215 73216 7ff72fa1815d 73215->73216 73217 7ff72f9d3c10 73216->73217 73266 7ff72f9e2810 73217->73266 73219 7ff72f9d3c23 std::ios_base::failure::failure 73219->73169 73271 7ff72f9d0f30 73220->73271 73222 7ff72fa189ff 73229 7ff72fa18b8e 73222->73229 73275 7ff72fa18110 51 API calls Concurrency::task_continuation_context::task_continuation_context 73222->73275 73223 7ff72fa18ce7 Concurrency::details::HardwareAffinity::operator!= 73224 7ff72f9d3be0 std::ios_base::failure::failure 47 API calls 73223->73224 73225 7ff72fa18d0e 73224->73225 73228 7ff72f9d3be0 std::ios_base::failure::failure 47 API calls 73225->73228 73226 7ff72fa18cbf 73226->73223 73277 7ff72fa18110 51 API calls Concurrency::task_continuation_context::task_continuation_context 73226->73277 73231 7ff72fa18d19 73228->73231 73229->73223 73229->73226 73276 7ff72fa18110 51 API calls Concurrency::task_continuation_context::task_continuation_context 73229->73276 73231->73171 73313 7ff72f9da5a0 73233->73313 73237 7ff72f9d04d0 73320 7ff72f9d83e0 73237->73320 73239 7ff72f9d04f6 73242 7ff72f9d3be0 73239->73242 73382 7ff72f9e2760 73242->73382 73244 7ff72f9d3bf3 std::ios_base::failure::failure 73244->73178 73245->73171 73246->73171 73247->73204 73248->73204 73250 7ff72f9e2dcf 73249->73250 73252 7ff72f9e2d4e Concurrency::details::WorkQueue::IsStructuredEmpty _Mpunct char_traits 73249->73252 73253 7ff72f9cde60 51 API calls 6 library calls 73250->73253 73252->73208 73253->73252 73255 7ff72f9d10d2 Concurrency::details::WorkQueue::IsStructuredEmpty Concurrency::cancellation_token::_FromImpl std::ios_base::failure::failure 73254->73255 73258 7ff72f9cb8d0 73255->73258 73257 7ff72f9d1136 73257->73212 73259 7ff72f9cb8f7 _Mpunct 73258->73259 73261 7ff72f9cb906 Concurrency::details::WorkQueue::IsStructuredEmpty _Mpunct 73259->73261 73264 7ff72f9e2970 51 API calls Concurrency::task_continuation_context::task_continuation_context 73259->73264 73263 7ff72f9cb942 _Mpunct Concurrency::task_continuation_context::task_continuation_context type_info::_name_internal_method shared_ptr 73261->73263 73265 7ff72f9caff0 49 API calls _Mpunct 73261->73265 73263->73257 73264->73261 73265->73263 73267 7ff72f9e282d Concurrency::details::WorkQueue::IsStructuredEmpty Concurrency::task_continuation_context::task_continuation_context 73266->73267 73269 7ff72f9e2869 shared_ptr char_traits 73267->73269 73270 7ff72f9df3c0 47 API calls shared_ptr 73267->73270 73269->73219 73270->73269 73272 7ff72f9d0f57 _Mpunct shared_ptr char_traits 73271->73272 73278 7ff72f9cb5d0 73272->73278 73274 7ff72f9d0f7c 73274->73222 73275->73222 73276->73229 73277->73226 73279 7ff72f9cb5f7 Concurrency::task_continuation_context::task_continuation_context 73278->73279 73280 7ff72f9cb603 Concurrency::details::WorkQueue::IsStructuredEmpty _Mpunct Concurrency::task_continuation_context::task_continuation_context 73279->73280 73287 7ff72f9e2970 51 API calls Concurrency::task_continuation_context::task_continuation_context 73279->73287 73283 7ff72f9cb63c _Mpunct Concurrency::task_continuation_context::task_continuation_context type_info::_name_internal_method shared_ptr char_traits 73280->73283 73284 7ff72f9caf90 73280->73284 73283->73274 73288 7ff72f9caf30 73284->73288 73287->73280 73291 7ff72f9e29b0 73288->73291 73292 7ff72f9e29c8 allocator 73291->73292 73295 7ff72f9caef0 73292->73295 73296 7ff72f9caf05 73295->73296 73297 7ff72f9caf01 73295->73297 73298 7ff72f9caf10 73296->73298 73299 7ff72f9caf1c 73296->73299 73297->73283 73302 7ff72f9cb050 73298->73302 73310 7ff72f9deb90 73299->73310 73303 7ff72f9cb073 73302->73303 73304 7ff72f9cb078 73302->73304 73305 7ff72f9e2260 allocator RtlPcToFileHeader RaiseException 73303->73305 73306 7ff72f9deb90 allocator RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 73304->73306 73305->73304 73308 7ff72f9cb083 73306->73308 73307 7ff72fbe8fa4 _invalid_parameter_noinfo_noreturn 47 API calls 73307->73308 73308->73307 73309 7ff72f9cb0a4 73308->73309 73309->73297 73311 7ff72fbe2bd0 std::_Facet_Register RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 73310->73311 73312 7ff72f9deba3 73311->73312 73312->73297 73337 7ff72f9da620 73313->73337 73316 7ff72f9d03d0 73317 7ff72f9d03de 73316->73317 73317->73317 73319 7ff72f9d041e UnDecorator::getVbTableType 73317->73319 73355 7ff72f9d8370 RtlPcToFileHeader RaiseException std::_Throw_Cpp_error atomic 73317->73355 73319->73237 73321 7ff72f9d04e0 73320->73321 73322 7ff72f9d83fb 73320->73322 73321->73239 73324 7ff72f9d4f80 73321->73324 73322->73321 73356 7ff72f9da8e0 56 API calls 73322->73356 73325 7ff72f9d4fa0 73324->73325 73326 7ff72f9d4f96 73324->73326 73328 7ff72f9d4fbd 73325->73328 73329 7ff72f9d4ffa 73325->73329 73357 7ff72f9da4a0 73326->73357 73360 7ff72f9da510 73328->73360 73367 7ff72f9d9650 RtlPcToFileHeader RaiseException std::ios_base::good Concurrency::task_continuation_context::task_continuation_context UnDecorator::getVbTableType 73329->73367 73333 7ff72f9d4ff7 73333->73239 73335 7ff72f9d4fe9 73364 7ff72f9dae00 73335->73364 73338 7ff72f9da649 73337->73338 73340 7ff72f9da68b 73337->73340 73353 7ff72fbe2efc AcquireSRWLockExclusive SleepConditionVariableSRW ReleaseSRWLockExclusive 73338->73353 73352 7ff72f9d04c3 73340->73352 73354 7ff72fbe2efc AcquireSRWLockExclusive SleepConditionVariableSRW ReleaseSRWLockExclusive 73340->73354 73352->73316 73355->73317 73356->73321 73368 7ff72f9debb0 73357->73368 73359 7ff72f9da4ae MultiByteToWideChar 73359->73325 73369 7ff72f9daa90 73360->73369 73363 7ff72f9d8690 MultiByteToWideChar 73363->73335 73377 7ff72f9dc0d0 73364->73377 73366 7ff72f9dae1b 73366->73333 73367->73333 73368->73359 73370 7ff72f9daaa4 73369->73370 73372 7ff72f9daaae std::ios_base::good 73369->73372 73375 7ff72f9d8370 RtlPcToFileHeader RaiseException std::_Throw_Cpp_error atomic 73370->73375 73373 7ff72f9d4fcb 73372->73373 73376 7ff72f9da9c0 49 API calls 2 library calls 73372->73376 73373->73363 73375->73372 73376->73373 73378 7ff72f9dc0e4 std::ios_base::good 73377->73378 73380 7ff72f9dc101 std::ios_base::good 73378->73380 73381 7ff72f9d8370 RtlPcToFileHeader RaiseException std::_Throw_Cpp_error atomic 73378->73381 73380->73366 73381->73380 73383 7ff72f9e277d Concurrency::details::WorkQueue::IsStructuredEmpty Concurrency::task_continuation_context::task_continuation_context 73382->73383 73385 7ff72f9e27b9 shared_ptr char_traits 73383->73385 73386 7ff72f9df380 47 API calls Concurrency::task_continuation_context::task_continuation_context 73383->73386 73385->73244 73386->73385 73435 7ff72fbfb6a4 73436 7ff72fbfd200 73435->73436 73448 7ff72fbf0764 73436->73448 73439 7ff72fbfd85b 73440 7ff72fbfd894 73463 7ff72fbe8fd4 IsProcessorFeaturePresent 73440->73463 73443 7ff72fc005f8 47 API calls __std_exception_copy 73446 7ff72fbfd227 memcpy_s 73443->73446 73446->73439 73446->73440 73446->73443 73447 7ff72fbfa5dc 47 API calls _Getctype 73446->73447 73456 7ff72fc00e10 73446->73456 73447->73446 73449 7ff72fbf0783 73448->73449 73450 7ff72fbf0788 73448->73450 73449->73446 73450->73449 73467 7ff72fc009fc GetLastError 73450->73467 73457 7ff72fc00e1f __std_fs_code_page 73456->73457 73458 7ff72fc00e5b 73456->73458 73457->73458 73459 7ff72fc00e42 HeapAlloc 73457->73459 73462 7ff72fbffffc std::_Facet_Register 2 API calls 73457->73462 73535 7ff72fbe90f0 11 API calls _get_daylight 73458->73535 73459->73457 73461 7ff72fc00e59 73459->73461 73461->73446 73462->73457 73464 7ff72fbe8fe7 73463->73464 73536 7ff72fbe8cb8 14 API calls 3 library calls 73464->73536 73466 7ff72fbe9002 GetCurrentProcess TerminateProcess 73468 7ff72fc00a20 FlsGetValue 73467->73468 73469 7ff72fc00a3d FlsSetValue 73467->73469 73470 7ff72fc00a2d 73468->73470 73471 7ff72fc00a37 73468->73471 73469->73470 73472 7ff72fc00a4f 73469->73472 73473 7ff72fc00aa9 SetLastError 73470->73473 73471->73469 73494 7ff72fc00d5c 73472->73494 73475 7ff72fbf07a3 73473->73475 73476 7ff72fc00ac9 73473->73476 73489 7ff72fc00e70 73475->73489 73510 7ff72fbefd98 47 API calls 2 library calls 73476->73510 73478 7ff72fc00a7c FlsSetValue 73482 7ff72fc00a9a 73478->73482 73483 7ff72fc00a88 FlsSetValue 73478->73483 73479 7ff72fc00a6c FlsSetValue 73481 7ff72fc00a75 73479->73481 73503 7ff72fc00dd4 73481->73503 73509 7ff72fc007ac 11 API calls __std_fs_code_page 73482->73509 73483->73481 73487 7ff72fc00aa2 73488 7ff72fc00dd4 __free_lconv_mon 11 API calls 73487->73488 73488->73473 73490 7ff72fc00e85 73489->73490 73491 7ff72fbf07c6 73489->73491 73490->73491 73522 7ff72fc0d80c 73490->73522 73493 7ff72fc00edc 47 API calls TranslateName 73491->73493 73493->73449 73495 7ff72fc00d6d 73494->73495 73502 7ff72fc00d7b __std_fs_code_page 73494->73502 73496 7ff72fc00dbe 73495->73496 73495->73502 73514 7ff72fbe90f0 11 API calls _get_daylight 73496->73514 73497 7ff72fc00da2 HeapAlloc 73498 7ff72fc00dbc 73497->73498 73497->73502 73500 7ff72fc00a5e 73498->73500 73500->73478 73500->73479 73502->73496 73502->73497 73511 7ff72fbffffc 73502->73511 73504 7ff72fc00e0a 73503->73504 73505 7ff72fc00dd9 RtlFreeHeap 73503->73505 73504->73470 73505->73504 73506 7ff72fc00df4 GetLastError 73505->73506 73507 7ff72fc00e01 __free_lconv_mon 73506->73507 73521 7ff72fbe90f0 11 API calls _get_daylight 73507->73521 73509->73487 73515 7ff72fc0003c 73511->73515 73514->73500 73520 7ff72fbfa724 EnterCriticalSection 73515->73520 73521->73504 73523 7ff72fc009fc __std_fs_code_page 47 API calls 73522->73523 73524 7ff72fc0d81b 73523->73524 73525 7ff72fc0d866 73524->73525 73534 7ff72fbfa724 EnterCriticalSection 73524->73534 73525->73491 73535->73461 73536->73466 73537 7ff72f9de340 73538 7ff72f9de395 73537->73538 73539 7ff72f9de36c 73537->73539 73540 7ff72f9de390 73538->73540 73541 7ff72f9de425 73538->73541 73547 7ff72f9de9ba PostQuitMessage 73539->73547 73548 7ff72f9de389 73539->73548 73611 7ff72f9de3b6 UnDecorator::getVbTableType 73539->73611 73549 7ff72f9de9c5 DefWindowProcW 73540->73549 73540->73611 73543 7ff72f9de434 73541->73543 73545 7ff72f9de6dd 73541->73545 73542 7ff72f9de9ec DefWindowProcW 73544 7ff72f9de414 73542->73544 73546 7ff72f9d11a0 _Mpunct 51 API calls 73543->73546 73550 7ff72f9d11a0 _Mpunct 51 API calls 73545->73550 73545->73611 73551 7ff72f9de458 73546->73551 73547->73542 73548->73540 73552 7ff72f9de3bb 73548->73552 73549->73542 73549->73544 73555 7ff72f9de710 73550->73555 73556 7ff72fa198a0 70 API calls 73551->73556 73553 7ff72f9de3d3 PostMessageW 73552->73553 73554 7ff72f9de3ef 73552->73554 73553->73544 73554->73544 73557 7ff72f9de3fa PostMessageW 73554->73557 73558 7ff72fa198a0 70 API calls 73555->73558 73559 7ff72f9de472 73556->73559 73557->73544 73560 7ff72f9de72d 73558->73560 73561 7ff72f9d11a0 _Mpunct 51 API calls 73559->73561 73562 7ff72f9d11a0 _Mpunct 51 API calls 73560->73562 73563 7ff72f9de497 73561->73563 73564 7ff72f9de752 73562->73564 73565 7ff72fa198a0 70 API calls 73563->73565 73566 7ff72fa198a0 70 API calls 73564->73566 73567 7ff72f9de4b1 73565->73567 73569 7ff72f9de76c 73566->73569 73568 7ff72f9d11a0 _Mpunct 51 API calls 73567->73568 73571 7ff72f9de4d6 73568->73571 73570 7ff72f9d11a0 _Mpunct 51 API calls 73569->73570 73572 7ff72f9de791 73570->73572 73573 7ff72fa198a0 70 API calls 73571->73573 73574 7ff72fa198a0 70 API calls 73572->73574 73575 7ff72f9de4f0 73573->73575 73576 7ff72f9de7ab 73574->73576 73612 7ff72f9d0510 73575->73612 73578 7ff72f9d0510 66 API calls 73576->73578 73580 7ff72f9de7bd 73578->73580 73582 7ff72f9d0510 66 API calls 73580->73582 73581 7ff72f9d0510 66 API calls 73583 7ff72f9de514 73581->73583 73584 7ff72f9de7cf 73582->73584 73585 7ff72f9d0450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 73583->73585 73586 7ff72f9d0450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 73584->73586 73587 7ff72f9de537 73585->73587 73588 7ff72f9de7f2 73586->73588 73621 7ff72fa18e90 73587->73621 73590 7ff72fa18e90 70 API calls 73588->73590 73592 7ff72f9de80f 73590->73592 73591 7ff72f9de554 73593 7ff72f9d0450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 73591->73593 73594 7ff72f9d0450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 73592->73594 73595 7ff72f9de59e 73593->73595 73596 7ff72f9de859 73594->73596 73597 7ff72fa18e90 70 API calls 73595->73597 73598 7ff72fa18e90 70 API calls 73596->73598 73599 7ff72f9de5bb 73597->73599 73601 7ff72f9de876 73598->73601 73600 7ff72f9d0450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 73599->73600 73603 7ff72f9de605 73600->73603 73602 7ff72f9d0450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 73601->73602 73604 7ff72f9de8c3 73602->73604 73605 7ff72fa18e90 70 API calls 73603->73605 73606 7ff72fa18e90 70 API calls 73604->73606 73607 7ff72f9de622 73605->73607 73608 7ff72f9de8e0 73606->73608 73654 7ff72fa5d350 88 API calls 5 library calls 73607->73654 73655 7ff72fa5d350 88 API calls 5 library calls 73608->73655 73611->73542 73613 7ff72f9da5a0 57 API calls 73612->73613 73614 7ff72f9d0523 73613->73614 73615 7ff72f9d03d0 2 API calls 73614->73615 73616 7ff72f9d0530 73615->73616 73617 7ff72f9d83e0 56 API calls 73616->73617 73618 7ff72f9d0540 73617->73618 73619 7ff72f9d0556 73618->73619 73656 7ff72f9d5010 49 API calls UnDecorator::getVbTableType 73618->73656 73619->73581 73622 7ff72fa18eb6 allocator 73621->73622 73623 7ff72f9d11a0 _Mpunct 51 API calls 73622->73623 73624 7ff72fa18ec6 73623->73624 73625 7ff72f9d3c10 shared_ptr 47 API calls 73624->73625 73628 7ff72fa18eea shared_ptr 73625->73628 73627 7ff72fa18fab 73629 7ff72fa18fbc 73627->73629 73635 7ff72fa19007 shared_ptr 73627->73635 73657 7ff72fa18610 73628->73657 73669 7ff72f9d05d0 73629->73669 73634 7ff72f9d3be0 std::ios_base::failure::failure 47 API calls 73653 7ff72fa18fec UnDecorator::getVbTableType 73634->73653 73677 7ff72f9c97a0 51 API calls 4 library calls 73635->73677 73637 7ff72fa1909d shared_ptr 73678 7ff72f9c97a0 51 API calls 4 library calls 73637->73678 73639 7ff72fa19152 73640 7ff72fa19e60 51 API calls 73639->73640 73641 7ff72fa19170 Concurrency::details::WorkQueue::IsStructuredEmpty 73640->73641 73642 7ff72f9d0510 66 API calls 73641->73642 73643 7ff72fa191a5 73642->73643 73644 7ff72f9d3c10 shared_ptr 47 API calls 73643->73644 73645 7ff72fa191bd 73644->73645 73646 7ff72f9d3c10 shared_ptr 47 API calls 73645->73646 73647 7ff72fa191cb 73646->73647 73648 7ff72f9d3c10 shared_ptr 47 API calls 73647->73648 73649 7ff72fa191d9 73648->73649 73650 7ff72fa17fa0 47 API calls 73649->73650 73651 7ff72fa191e4 73650->73651 73652 7ff72f9d3be0 std::ios_base::failure::failure 47 API calls 73651->73652 73652->73653 73653->73591 73654->73611 73655->73611 73656->73619 73658 7ff72f9d0f30 _Mpunct 51 API calls 73657->73658 73668 7ff72fa1863a Concurrency::details::HardwareAffinity::operator!= 73658->73668 73659 7ff72fa18981 73660 7ff72fa17fa0 47 API calls 73659->73660 73661 7ff72fa189a8 73660->73661 73664 7ff72f9d3be0 std::ios_base::failure::failure 47 API calls 73661->73664 73662 7ff72fa18838 73662->73659 73681 7ff72fa19e00 51 API calls 73662->73681 73665 7ff72fa189b3 73664->73665 73665->73627 73668->73662 73679 7ff72fa19d60 50 API calls 73668->73679 73680 7ff72fa19e00 51 API calls 73668->73680 73670 7ff72f9da5a0 57 API calls 73669->73670 73671 7ff72f9d05de 73670->73671 73672 7ff72f9d03d0 2 API calls 73671->73672 73673 7ff72f9d05eb 73672->73673 73674 7ff72fa17fa0 73673->73674 73682 7ff72fa184f0 73674->73682 73677->73637 73678->73639 73679->73668 73680->73668 73681->73662 73684 7ff72fa18503 Concurrency::details::WorkQueue::IsStructuredEmpty Concurrency::task_continuation_context::task_continuation_context 73682->73684 73683 7ff72fa17fb3 73683->73634 73684->73683 73686 7ff72f9e4850 73684->73686 73689 7ff72f9cbc30 73686->73689 73688 7ff72f9e4878 73688->73683 73690 7ff72f9cbc49 73689->73690 73692 7ff72f9cbc58 std::_Throw_Cpp_error 73689->73692 73693 7ff72f9dea40 47 API calls _invalid_parameter_noinfo_noreturn 73690->73693 73692->73688 73693->73692 73694 7ff72fa01e41 73695 7ff72fa01eb1 73694->73695 73696 7ff72fa01e52 73694->73696 73702 7ff72f9d5700 73696->73702 73700 7ff72fa01e85 73709 7ff72fa05a10 13 API calls 2 library calls 73700->73709 73703 7ff72f9d5753 73702->73703 73704 7ff72f9d5714 73702->73704 73708 7ff72fa06d70 93 API calls 73703->73708 73710 7ff72fbc13e8 73704->73710 73706 7ff72f9d5720 73714 7ff72fbc1460 73706->73714 73708->73700 73709->73695 73711 7ff72fbc13f7 73710->73711 73712 7ff72fbc13fc 73710->73712 73718 7ff72fbfa794 6 API calls std::_Locinfo::_Locinfo_ctor 73711->73718 73712->73706 73715 7ff72fbc1474 73714->73715 73716 7ff72fbc146b LeaveCriticalSection 73714->73716 73715->73703 73719 7ff72f9e9540 73720 7ff72f9d11a0 _Mpunct 51 API calls 73719->73720 73721 7ff72f9e956a 73720->73721 73722 7ff72fa198a0 70 API calls 73721->73722 73723 7ff72f9e957e 73722->73723 73724 7ff72f9d11a0 _Mpunct 51 API calls 73723->73724 73725 7ff72f9e959d 73724->73725 73726 7ff72fa198a0 70 API calls 73725->73726 73727 7ff72f9e95b1 73726->73727 73746 7ff72fa717a0 ShowWindow 73727->73746 73729 7ff72f9e95c6 73730 7ff72f9d0510 66 API calls 73729->73730 73731 7ff72f9e95d8 73730->73731 73732 7ff72f9d0510 66 API calls 73731->73732 73733 7ff72f9e95ea 73732->73733 73734 7ff72f9d0510 66 API calls 73733->73734 73735 7ff72f9e95fc 73734->73735 73736 7ff72f9d0450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 73735->73736 73737 7ff72f9e9619 73736->73737 73738 7ff72fa18e90 70 API calls 73737->73738 73739 7ff72f9e9636 73738->73739 73740 7ff72f9d0450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 73739->73740 73741 7ff72f9e9680 73740->73741 73742 7ff72fa18e90 70 API calls 73741->73742 73743 7ff72f9e969d 73742->73743 73749 7ff72fa5ca30 73743->73749 73745 7ff72f9e96ee UnDecorator::getVbTableType 73747 7ff72fa717be 73746->73747 73748 7ff72fa717ca UpdateWindow 73746->73748 73747->73748 73748->73729 73770 7ff72fa4f060 73749->73770 73751 7ff72fa5ca55 allocator 73769 7ff72fa5ca84 73751->73769 73773 7ff72fa5d4d0 51 API calls Concurrency::cancellation_token::_FromImpl 73751->73773 73753 7ff72fa5caa5 Concurrency::details::WorkQueue::IsStructuredEmpty 73754 7ff72f9d0510 66 API calls 73753->73754 73755 7ff72fa5cacb 73754->73755 73756 7ff72f9d3c10 shared_ptr 47 API calls 73755->73756 73757 7ff72fa5cad9 73756->73757 73758 7ff72f9d0450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 73757->73758 73759 7ff72fa5caec 73758->73759 73760 7ff72f9d0450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 73759->73760 73761 7ff72fa5caff 73760->73761 73762 7ff72f9d0450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 73761->73762 73763 7ff72fa5cb12 73762->73763 73764 7ff72f9d0450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 73763->73764 73765 7ff72fa5cb25 73764->73765 73766 7ff72f9d0450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 73765->73766 73767 7ff72fa5cb38 73766->73767 73774 7ff72fa1bb30 58 API calls Concurrency::details::WorkQueue::IsStructuredEmpty 73767->73774 73769->73745 73775 7ff72fbc1990 73770->73775 73772 7ff72fa4f06e _Subatomic 73772->73751 73773->73753 73774->73769 73778 7ff72fbc7b24 73775->73778 73779 7ff72fbc7b40 GetSystemTimeAsFileTime 73778->73779 73780 7ff72fbc199e 73778->73780 73780->73772 73781 7ff72fa242b0 73784 7ff72fbf689c 73781->73784 73785 7ff72fbf68d6 73784->73785 73786 7ff72fbf68b8 73784->73786 73805 7ff72fbf6450 EnterCriticalSection 73785->73805 73806 7ff72fbe90f0 11 API calls _get_daylight 73786->73806 73790 7ff72fbf68bd 73807 7ff72fbe8f84 47 API calls _invalid_parameter_noinfo_noreturn 73790->73807 73803 7ff72fa242c8 73806->73790 73807->73803 73808 7ff72fa3c490 GetWindowTextW 73809 7ff72f9d0450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 73808->73809 73810 7ff72fa3c4eb 73809->73810 73811 7ff72fa18e90 70 API calls 73810->73811 73812 7ff72fa3c4ff allocator ProcessCodePage 73811->73812 73813 7ff72f9d0450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 73812->73813 73820 7ff72fa3c569 allocator ProcessCodePage UnDecorator::getVbTableType 73812->73820 73814 7ff72fa3c555 73813->73814 73815 7ff72fa18e90 70 API calls 73814->73815 73815->73820 73816 7ff72fa3c63e 73817 7ff72f9d11a0 _Mpunct 51 API calls 73818 7ff72fa3c613 73817->73818 73823 7ff72fa38130 51 API calls shared_ptr 73818->73823 73820->73816 73820->73817 73821 7ff72fa3c626 73822 7ff72f9d3c10 shared_ptr 47 API calls 73821->73822 73822->73816 73823->73821 73824 7ff72fa33bd0 73829 7ff72fa33530 73824->73829 73836 7ff72fa351c0 73829->73836 73832 7ff72fa35110 73833 7ff72fa35132 Concurrency::details::WorkQueue::IsStructuredEmpty std::ios_base::failure::failure 73832->73833 73854 7ff72fa20710 73833->73854 73835 7ff72fa33c12 73839 7ff72fa33ed0 73836->73839 73838 7ff72fa33572 73838->73832 73842 7ff72fa35000 73839->73842 73841 7ff72fa33efa codecvt 73841->73838 73843 7ff72fa35022 Concurrency::details::WorkQueue::IsStructuredEmpty std::ios_base::failure::failure 73842->73843 73846 7ff72fa20610 73843->73846 73845 7ff72fa3509c 73845->73841 73847 7ff72fa20632 Concurrency::details::WorkQueue::IsStructuredEmpty _Mpunct 73846->73847 73848 7ff72fa206f3 Concurrency::task_continuation_context::task_continuation_context 73847->73848 73852 7ff72fa3e400 51 API calls 73847->73852 73848->73845 73850 7ff72fa2067d shared_ptr 73853 7ff72fa36c10 47 API calls 73850->73853 73852->73850 73853->73848 73855 7ff72fa20732 Concurrency::details::WorkQueue::IsStructuredEmpty _Mpunct 73854->73855 73856 7ff72fa207f3 Concurrency::task_continuation_context::task_continuation_context 73855->73856 73860 7ff72f9fa7d0 73855->73860 73856->73835 73858 7ff72fa2077d shared_ptr 73866 7ff72fa36c40 47 API calls 73858->73866 73861 7ff72f9fa7e8 73860->73861 73862 7ff72f9fa7f4 73861->73862 73871 7ff72f9fb0d0 51 API calls Concurrency::task_continuation_context::task_continuation_context 73861->73871 73867 7ff72f9fa8b0 73862->73867 73866->73856 73868 7ff72f9fa8f8 Concurrency::details::WorkQueue::IsStructuredEmpty 73867->73868 73872 7ff72f9f2150 73868->73872 73871->73862 73875 7ff72f9fb140 73872->73875 73880 7ff72f9f3f70 73875->73880 73878 7ff72f9caef0 allocator 49 API calls 73879 7ff72f9f2170 73878->73879 73879->73858 73881 7ff72f9f3f9e 73880->73881 73883 7ff72f9f3fa3 73880->73883 73884 7ff72f9e2260 RtlPcToFileHeader RaiseException stdext::threads::lock_error::lock_error std::_Throw_Cpp_error 73881->73884 73883->73878 73884->73883 73885 7ff72fbc4e5c 73886 7ff72fbc13e8 std::_Lockit::_Lockit 6 API calls 73885->73886 73887 7ff72fbc4e85 73886->73887 73888 7ff72fbc4f47 73887->73888 73890 7ff72fbc4eb6 73887->73890 73900 7ff72fbc1810 73888->73900 73891 7ff72fbc1460 std::_Lockit::~_Lockit LeaveCriticalSection 73890->73891 73892 7ff72fbc4f31 73891->73892 73901 7ff72fbc181e std::bad_alloc::bad_alloc 73900->73901 73904 7ff72fbe3da0 RtlPcToFileHeader RaiseException 73901->73904 73903 7ff72fbc182f 73904->73903 73905 7ff72f9c1270 73906 7ff72f9d11a0 _Mpunct 51 API calls 73905->73906 73907 7ff72f9c128f 73906->73907 73908 7ff72fa198a0 70 API calls 73907->73908 73909 7ff72f9c12a3 allocator 73908->73909 73910 7ff72f9d11a0 _Mpunct 51 API calls 73909->73910 73911 7ff72f9c12cb UnDecorator::getVbTableType 73910->73911 73912 7ff72fbe2e3c 50 API calls 73911->73912 73913 7ff72f9c12e3 73912->73913 73914 7ff72f9d97d0 73915 7ff72f9d11a0 _Mpunct 51 API calls 73914->73915 73916 7ff72f9d980e 73915->73916 73917 7ff72fa198a0 70 API calls 73916->73917 73918 7ff72f9d9825 allocator 73917->73918 73919 7ff72f9d11a0 _Mpunct 51 API calls 73918->73919 73920 7ff72f9d985a UnDecorator::getVbTableType 73919->73920 73921 7ff72f9d11a0 _Mpunct 51 API calls 73920->73921 73922 7ff72f9d988d 73921->73922 73923 7ff72fa198a0 70 API calls 73922->73923 73924 7ff72f9d98aa allocator 73923->73924 73925 7ff72f9d11a0 _Mpunct 51 API calls 73924->73925 73926 7ff72f9d98dc UnDecorator::getVbTableType 73925->73926 73927 7ff72f9d11a0 _Mpunct 51 API calls 73926->73927 73928 7ff72f9d990f 73927->73928 73929 7ff72fa198a0 70 API calls 73928->73929 73930 7ff72f9d992c allocator 73929->73930 73931 7ff72f9d11a0 _Mpunct 51 API calls 73930->73931 73932 7ff72f9d9961 UnDecorator::getVbTableType 73931->73932 73933 7ff72f9d11a0 _Mpunct 51 API calls 73932->73933 73934 7ff72f9d9994 73933->73934 73935 7ff72fa198a0 70 API calls 73934->73935 73936 7ff72f9d99b1 allocator 73935->73936 73937 7ff72f9d11a0 _Mpunct 51 API calls 73936->73937 73938 7ff72f9d99e6 UnDecorator::getVbTableType 73937->73938 73939 7ff72f9d11a0 _Mpunct 51 API calls 73938->73939 73940 7ff72f9d9a19 73939->73940 73941 7ff72fa198a0 70 API calls 73940->73941 73942 7ff72f9d9a36 allocator 73941->73942 73943 7ff72f9d11a0 _Mpunct 51 API calls 73942->73943 73944 7ff72f9d9a6b UnDecorator::getVbTableType 73943->73944 73945 7ff72f9d9a79 GetClassNameW 73944->73945 73946 7ff72f9d9ae7 GetWindowTextW 73945->73946 73947 7ff72f9d9b59 73945->73947 73946->73947 73949 7ff72f9d9b06 73946->73949 73948 7ff72f9d10b0 51 API calls 73947->73948 73959 7ff72f9d9b7e allocator ProcessCodePage UnDecorator::getVbTableType 73948->73959 73950 7ff72f9d3c10 shared_ptr 47 API calls 73949->73950 73951 7ff72f9d9b1b 73950->73951 73952 7ff72f9d3c10 shared_ptr 47 API calls 73951->73952 73953 7ff72f9d9b29 73952->73953 73954 7ff72f9d3c10 shared_ptr 47 API calls 73953->73954 73955 7ff72f9d9b37 73954->73955 73956 7ff72f9d3c10 shared_ptr 47 API calls 73955->73956 73957 7ff72f9d9b42 73956->73957 73958 7ff72f9d3c10 shared_ptr 47 API calls 73957->73958 73982 7ff72f9d9b50 73958->73982 73960 7ff72f9d9bf9 EnumChildWindows EnumChildWindows EnumChildWindows 73959->73960 73961 7ff72f9d9cad 73959->73961 73962 7ff72f9d3c10 shared_ptr 47 API calls 73960->73962 73963 7ff72f9d10b0 51 API calls 73961->73963 73971 7ff72f9d9cde allocator ProcessCodePage UnDecorator::getVbTableType 73961->73971 73964 7ff72f9d9c6f 73962->73964 73963->73971 73965 7ff72f9d3c10 shared_ptr 47 API calls 73964->73965 73966 7ff72f9d9c7d 73965->73966 73967 7ff72f9d3c10 shared_ptr 47 API calls 73966->73967 73972 7ff72f9d9c8b 73967->73972 73968 7ff72f9d10b0 51 API calls 73983 7ff72f9d9d84 allocator ProcessCodePage UnDecorator::getVbTableType 73968->73983 73969 7ff72f9d9e35 73973 7ff72f9d3c10 shared_ptr 47 API calls 73969->73973 73970 7ff72f9d9e97 73975 7ff72f9d10b0 51 API calls 73970->73975 73988 7ff72f9d9ecb allocator ProcessCodePage UnDecorator::getVbTableType 73970->73988 73971->73968 73971->73983 73974 7ff72f9d3c10 shared_ptr 47 API calls 73972->73974 73976 7ff72f9d9e59 73973->73976 73977 7ff72f9d9c96 73974->73977 73975->73988 73979 7ff72f9d3c10 shared_ptr 47 API calls 73976->73979 73978 7ff72f9d3c10 shared_ptr 47 API calls 73977->73978 73978->73982 73984 7ff72f9d9e67 73979->73984 73980 7ff72f9d9fc0 73990 7ff72f9d10b0 51 API calls 73980->73990 74001 7ff72f9d9ff4 allocator ProcessCodePage UnDecorator::getVbTableType 73980->74001 73981 7ff72f9d9f5e 73985 7ff72f9d3c10 shared_ptr 47 API calls 73981->73985 73983->73969 73983->73970 73986 7ff72f9d3c10 shared_ptr 47 API calls 73984->73986 73987 7ff72f9d9f82 73985->73987 73989 7ff72f9d9e75 73986->73989 73991 7ff72f9d3c10 shared_ptr 47 API calls 73987->73991 73988->73980 73988->73981 73992 7ff72f9d3c10 shared_ptr 47 API calls 73989->73992 73990->74001 73993 7ff72f9d9f90 73991->73993 73996 7ff72f9d9e80 73992->73996 73997 7ff72f9d3c10 shared_ptr 47 API calls 73993->73997 73994 7ff72f9da0e6 73998 7ff72f9d3c10 shared_ptr 47 API calls 73994->73998 73995 7ff72f9da087 73999 7ff72f9d3c10 shared_ptr 47 API calls 73995->73999 74000 7ff72f9d3c10 shared_ptr 47 API calls 73996->74000 74002 7ff72f9d9f9e 73997->74002 74003 7ff72f9da0fb 73998->74003 74004 7ff72f9da0ab 73999->74004 74000->73982 74001->73994 74001->73995 74005 7ff72f9d3c10 shared_ptr 47 API calls 74002->74005 74006 7ff72f9d3c10 shared_ptr 47 API calls 74003->74006 74007 7ff72f9d3c10 shared_ptr 47 API calls 74004->74007 74009 7ff72f9d9fa9 74005->74009 74010 7ff72f9da109 74006->74010 74008 7ff72f9da0b9 74007->74008 74011 7ff72f9d3c10 shared_ptr 47 API calls 74008->74011 74012 7ff72f9d3c10 shared_ptr 47 API calls 74009->74012 74013 7ff72f9d3c10 shared_ptr 47 API calls 74010->74013 74014 7ff72f9da0c7 74011->74014 74012->73982 74015 7ff72f9da117 74013->74015 74016 7ff72f9d3c10 shared_ptr 47 API calls 74014->74016 74017 7ff72f9d3c10 shared_ptr 47 API calls 74015->74017 74018 7ff72f9da0d2 74016->74018 74019 7ff72f9da122 74017->74019 74021 7ff72f9d3c10 shared_ptr 47 API calls 74018->74021 74020 7ff72f9d3c10 shared_ptr 47 API calls 74019->74020 74020->73982 74021->73982 74022 7ff72f9dc290 74023 7ff72f9dc2a8 ctype 74022->74023 74349 7ff72f9ea0d0 74023->74349 74025 7ff72f9dc2b8 74426 7ff72f9ed500 74025->74426 74028 7ff72f9d11a0 _Mpunct 51 API calls 74029 7ff72f9dc2ef 74028->74029 74030 7ff72fa198a0 70 API calls 74029->74030 74031 7ff72f9dc309 74030->74031 74032 7ff72f9d11a0 _Mpunct 51 API calls 74031->74032 74033 7ff72f9dc32e 74032->74033 74034 7ff72fa198a0 70 API calls 74033->74034 74035 7ff72f9dc348 74034->74035 74036 7ff72f9d11a0 _Mpunct 51 API calls 74035->74036 74037 7ff72f9dc36d 74036->74037 74038 7ff72fa198a0 70 API calls 74037->74038 74039 7ff72f9dc387 74038->74039 74040 7ff72f9d11a0 _Mpunct 51 API calls 74039->74040 74041 7ff72f9dc3ac 74040->74041 74042 7ff72fa198a0 70 API calls 74041->74042 74043 7ff72f9dc3c6 74042->74043 74044 7ff72f9d11a0 _Mpunct 51 API calls 74043->74044 74045 7ff72f9dc3eb 74044->74045 74046 7ff72fa198a0 70 API calls 74045->74046 74047 7ff72f9dc405 74046->74047 74048 7ff72f9d11a0 _Mpunct 51 API calls 74047->74048 74049 7ff72f9dc42a 74048->74049 74050 7ff72fa198a0 70 API calls 74049->74050 74051 7ff72f9dc447 allocator 74050->74051 74052 7ff72f9d11a0 _Mpunct 51 API calls 74051->74052 74053 7ff72f9dc47c UnDecorator::getVbTableType 74052->74053 74054 7ff72f9d11a0 _Mpunct 51 API calls 74053->74054 74055 7ff72f9dc4af 74054->74055 74056 7ff72fa198a0 70 API calls 74055->74056 74057 7ff72f9dc4c9 74056->74057 74058 7ff72f9d05d0 59 API calls 74057->74058 74059 7ff72f9dc4d4 74058->74059 74450 7ff72fa3a6b0 74059->74450 74061 7ff72f9dc4e2 allocator 74466 7ff72f9da250 74061->74466 74063 7ff72f9dc54c UnDecorator::getVbTableType 74064 7ff72f9d0510 66 API calls 74063->74064 74065 7ff72f9dc56f 74064->74065 74066 7ff72f9d0510 66 API calls 74065->74066 74067 7ff72f9dc584 74066->74067 74068 7ff72f9d0450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 74067->74068 74069 7ff72f9dc5a7 74068->74069 74070 7ff72fa18e90 70 API calls 74069->74070 74071 7ff72f9dc5c4 74070->74071 74072 7ff72f9d0450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 74071->74072 74073 7ff72f9dc60e 74072->74073 74074 7ff72fa18e90 70 API calls 74073->74074 74075 7ff72f9dc62b 74074->74075 74076 7ff72fa5ca30 75 API calls 74075->74076 74077 7ff72f9dc682 UnDecorator::getVbTableType 74076->74077 74469 7ff72f9c8ad0 74077->74469 74350 7ff72f9e62c0 73 API calls 74349->74350 74351 7ff72f9ea0e9 74350->74351 74352 7ff72f9d11a0 _Mpunct 51 API calls 74351->74352 74425 7ff72f9ea6b2 UnDecorator::getVbTableType 74351->74425 74353 7ff72f9ea11c 74352->74353 74354 7ff72fa198a0 70 API calls 74353->74354 74355 7ff72f9ea136 74354->74355 74356 7ff72f9d11a0 _Mpunct 51 API calls 74355->74356 74357 7ff72f9ea15b 74356->74357 74358 7ff72fa198a0 70 API calls 74357->74358 74359 7ff72f9ea175 74358->74359 74360 7ff72f9d05d0 59 API calls 74359->74360 74361 7ff72f9ea180 74360->74361 74362 7ff72f9d05d0 59 API calls 74361->74362 74363 7ff72f9ea18b 74362->74363 74364 7ff72f9ea1ab 74363->74364 74365 7ff72f9ea19b 74363->74365 74366 7ff72f9d11a0 _Mpunct 51 API calls 74364->74366 74367 7ff72f9ea1a6 74365->74367 74368 7ff72f9ea22a 74365->74368 74369 7ff72f9ea1cf 74366->74369 74371 7ff72f9d05d0 59 API calls 74367->74371 74370 7ff72f9d11a0 _Mpunct 51 API calls 74368->74370 74372 7ff72fa198a0 70 API calls 74369->74372 74373 7ff72f9ea24e 74370->74373 74374 7ff72f9ea2b3 74371->74374 74375 7ff72f9ea1ec 74372->74375 74376 7ff72fa198a0 70 API calls 74373->74376 74377 7ff72f9d11a0 _Mpunct 51 API calls 74374->74377 75315 7ff72f9d4f50 74375->75315 74379 7ff72f9ea26b 74376->74379 74380 7ff72f9ea2d8 74377->74380 74381 7ff72f9d4f50 UnDecorator::getVbTableType 49 API calls 74379->74381 74382 7ff72fa198a0 70 API calls 74380->74382 74385 7ff72f9ea216 UnDecorator::getVbTableType 74381->74385 74383 7ff72f9ea2f5 74382->74383 74384 7ff72f9d4f50 UnDecorator::getVbTableType 49 API calls 74383->74384 74386 7ff72f9ea31f UnDecorator::getVbTableType 74384->74386 74387 7ff72f9d11a0 _Mpunct 51 API calls 74385->74387 74390 7ff72f9d0450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 74386->74390 74388 7ff72f9ea46f 74387->74388 74389 7ff72fa198a0 70 API calls 74388->74389 74391 7ff72f9ea489 74389->74391 74392 7ff72f9ea350 74390->74392 74393 7ff72f9d0450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 74391->74393 74394 7ff72fa18e90 70 API calls 74392->74394 74395 7ff72f9ea4ac 74393->74395 74396 7ff72f9ea36d allocator 74394->74396 74397 7ff72fa18e90 70 API calls 74395->74397 74400 7ff72f9da250 68 API calls 74396->74400 74398 7ff72f9ea4c9 74397->74398 74399 7ff72f9d0450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 74398->74399 74401 7ff72f9ea516 74399->74401 74404 7ff72f9ea3a4 allocator UnDecorator::getVbTableType 74400->74404 74402 7ff72fa18e90 70 API calls 74401->74402 74403 7ff72f9ea533 allocator 74402->74403 74405 7ff72f9da250 68 API calls 74403->74405 74406 7ff72f9d11a0 _Mpunct 51 API calls 74404->74406 74410 7ff72f9ea57a UnDecorator::getVbTableType 74405->74410 74407 7ff72f9ea3dd 74406->74407 74408 7ff72fa198a0 70 API calls 74407->74408 74409 7ff72f9ea3fa 74408->74409 74411 7ff72f9d4f50 UnDecorator::getVbTableType 49 API calls 74409->74411 74412 7ff72f9d0510 66 API calls 74410->74412 74411->74385 74413 7ff72f9ea5a8 74412->74413 74414 7ff72f9d0510 66 API calls 74413->74414 74415 7ff72f9ea5ba 74414->74415 74416 7ff72f9d0450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 74415->74416 74417 7ff72f9ea5dd 74416->74417 74418 7ff72fa18e90 70 API calls 74417->74418 74419 7ff72f9ea5fa 74418->74419 74420 7ff72f9d0450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 74419->74420 74421 7ff72f9ea644 74420->74421 74422 7ff72fa18e90 70 API calls 74421->74422 74423 7ff72f9ea661 74422->74423 74424 7ff72fa5ca30 75 API calls 74423->74424 74424->74425 74425->74025 74427 7ff72f9d11a0 _Mpunct 51 API calls 74426->74427 74428 7ff72f9ed52e 74427->74428 74429 7ff72fa198a0 70 API calls 74428->74429 74430 7ff72f9ed542 allocator 74429->74430 74431 7ff72f9d11a0 _Mpunct 51 API calls 74430->74431 74432 7ff72f9ed56b UnDecorator::getVbTableType 74431->74432 74433 7ff72f9d11a0 _Mpunct 51 API calls 74432->74433 74434 7ff72f9ed595 74433->74434 74435 7ff72fa198a0 70 API calls 74434->74435 74436 7ff72f9ed5b2 allocator 74435->74436 74437 7ff72f9d11a0 _Mpunct 51 API calls 74436->74437 74438 7ff72f9ed5e7 UnDecorator::getVbTableType 74437->74438 74439 7ff72f9ed5f5 GetModuleFileNameW 74438->74439 74440 7ff72f9d10b0 51 API calls 74439->74440 74441 7ff72f9ed632 allocator 74440->74441 74442 7ff72f9ed664 RegOpenKeyExW 74441->74442 74443 7ff72f9ed698 UnDecorator::getVbTableType 74442->74443 74444 7ff72f9ed705 74443->74444 74445 7ff72f9ed6a0 RegSetValueExW RegCloseKey 74443->74445 74446 7ff72f9d3c10 shared_ptr 47 API calls 74444->74446 74445->74444 74447 7ff72f9ed712 74446->74447 74448 7ff72f9d3c10 shared_ptr 47 API calls 74447->74448 74449 7ff72f9dc2ca 74448->74449 74449->74028 74451 7ff72f9d05d0 59 API calls 74450->74451 74452 7ff72fa3a6ce 74451->74452 75326 7ff72f9da530 74452->75326 74455 7ff72fa3a70b 74458 7ff72f9d11a0 _Mpunct 51 API calls 74455->74458 74456 7ff72fa3a796 74457 7ff72f9d0450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 74456->74457 74465 7ff72fa3a76b UnDecorator::getVbTableType 74457->74465 74459 7ff72fa3a726 74458->74459 74460 7ff72fa198a0 70 API calls 74459->74460 74461 7ff72fa3a73a 74460->74461 74462 7ff72f9d0450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 74461->74462 74463 7ff72fa3a754 74462->74463 74464 7ff72fa18e90 70 API calls 74463->74464 74464->74465 74465->74061 75331 7ff72f9da320 74466->75331 74468 7ff72f9da286 74468->74063 74470 7ff72f9c8aed shared_ptr 74469->74470 75422 7ff72f9cec10 74470->75422 75318 7ff72f9d4e50 75315->75318 75317 7ff72f9d4f6d 75317->74385 75319 7ff72f9d4e68 std::ios_base::good UnDecorator::getVbTableType 75318->75319 75320 7ff72f9d4ee3 75319->75320 75322 7ff72f9d4eaf allocator std::ios_base::good 75319->75322 75323 7ff72f9d4ee0 UnDecorator::getVbTableType 75319->75323 75321 7ff72f9d8440 UnDecorator::getVbTableType 49 API calls 75320->75321 75321->75323 75325 7ff72f9dc180 49 API calls 5 library calls 75322->75325 75323->75317 75325->75323 75328 7ff72f9da543 strrchr std::ios_base::good 75326->75328 75327 7ff72f9da56b GetUserDefaultUILanguage LCIDToLocaleName 75327->74455 75327->74456 75328->75327 75330 7ff72f9da140 49 API calls 2 library calls 75328->75330 75330->75327 75332 7ff72f9da345 75331->75332 75333 7ff72f9da33b 75331->75333 75349 7ff72f9da5b0 75332->75349 75368 7ff72f9d8370 RtlPcToFileHeader RaiseException std::_Throw_Cpp_error atomic 75333->75368 75337 7ff72f9da36a 75353 7ff72f9da780 75337->75353 75343 7ff72f9da510 strrchr 49 API calls 75344 7ff72f9da396 allocator 75343->75344 75364 7ff72f9da2a0 75344->75364 75347 7ff72f9dae00 Concurrency::task_continuation_context::task_continuation_context 2 API calls 75348 7ff72f9da3d1 UnDecorator::getVbTableType 75347->75348 75348->74468 75350 7ff72f9da5c3 _vswprintf_s_l 75349->75350 75370 7ff72fbef358 75350->75370 75355 7ff72f9da793 75353->75355 75354 7ff72f9da375 75357 7ff72f9d0570 75354->75357 75355->75354 75356 7ff72f9da5a0 57 API calls 75355->75356 75356->75354 75358 7ff72f9d03d0 2 API calls 75357->75358 75359 7ff72f9d0592 75358->75359 75360 7ff72f9d83e0 56 API calls 75359->75360 75361 7ff72f9d05a2 75360->75361 75362 7ff72f9d05b8 75361->75362 75407 7ff72f9d5010 49 API calls UnDecorator::getVbTableType 75361->75407 75362->75343 75365 7ff72f9da2bd _vswprintf_s_l 75364->75365 75408 7ff72fbef5b4 75365->75408 75368->75332 75369 7ff72f9d8370 RtlPcToFileHeader RaiseException std::_Throw_Cpp_error atomic 75369->75337 75374 7ff72fbef3b2 75370->75374 75371 7ff72fbef3d7 75401 7ff72fbe8eb8 47 API calls 2 library calls 75371->75401 75373 7ff72fbef413 75402 7ff72fbecdb4 50 API calls _vswprintf_s_l 75373->75402 75374->75371 75374->75373 75376 7ff72fbef401 75380 7ff72fbef575 75376->75380 75403 7ff72fbe8b98 47 API calls 2 library calls 75376->75403 75377 7ff72fbef4ae 75385 7ff72fbef4f4 75377->75385 75386 7ff72fbef4c9 75377->75386 75387 7ff72fbef51a 75377->75387 75390 7ff72fbef4c0 75377->75390 75379 7ff72fbef58b 75392 7ff72fbe31a0 75379->75392 75380->75379 75404 7ff72fbe8b98 47 API calls 2 library calls 75380->75404 75383 7ff72fc00dd4 __free_lconv_mon 11 API calls 75383->75376 75385->75383 75389 7ff72fc00dd4 __free_lconv_mon 11 API calls 75386->75389 75387->75385 75388 7ff72fbef524 75387->75388 75391 7ff72fc00dd4 __free_lconv_mon 11 API calls 75388->75391 75389->75376 75390->75385 75390->75386 75391->75376 75393 7ff72fbe31a9 75392->75393 75394 7ff72f9da355 75393->75394 75395 7ff72fbe39c4 IsProcessorFeaturePresent 75393->75395 75394->75337 75394->75369 75396 7ff72fbe39dc 75395->75396 75405 7ff72fbe3bbc RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind 75396->75405 75398 7ff72fbe39ef 75406 7ff72fbe3990 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 75398->75406 75401->75376 75402->75377 75403->75380 75404->75379 75405->75398 75407->75362 75409 7ff72fbef5ed 75408->75409 75412 7ff72fbef630 75409->75412 75418 7ff72fbe9cdc 50 API calls 3 library calls 75409->75418 75413 7ff72fbef66f 75412->75413 75419 7ff72fbe8eb8 47 API calls 2 library calls 75412->75419 75415 7ff72fbef695 75413->75415 75420 7ff72fbe8b98 47 API calls 2 library calls 75413->75420 75417 7ff72f9da2ee 75415->75417 75421 7ff72fbe8b98 47 API calls 2 library calls 75415->75421 75417->75347 75418->75412 75419->75413 75420->75415 75421->75417 75423 7ff72f9cec30 shared_ptr 75422->75423 75430 7ff72f9cfc90 75423->75430 75425 7ff72f9cec58 allocator 75433 7ff72fbefc38 75425->75433 75452 7ff72fbe2bd0 75430->75452 75432 7ff72f9cfcb5 type_info::_name_internal_method shared_ptr 75432->75425 75434 7ff72fbefc6f 75433->75434 75435 7ff72fbefc58 75433->75435 75462 7ff72fbefb0c 75434->75462 75469 7ff72fbe90f0 11 API calls _get_daylight 75435->75469 75438 7ff72fbefc5d 75470 7ff72fbe8f84 47 API calls _invalid_parameter_noinfo_noreturn 75438->75470 75454 7ff72fbe2bdb 75452->75454 75453 7ff72fbe2bf4 75453->75432 75454->75453 75455 7ff72fbffffc std::_Facet_Register 2 API calls 75454->75455 75456 7ff72fbe2bfa 75454->75456 75455->75454 75457 7ff72fbc1810 Concurrency::cancel_current_task 2 API calls 75456->75457 75459 7ff72fbe2c05 75456->75459 75457->75459 75461 7ff72fbe3960 RtlPcToFileHeader RaiseException stdext::threads::lock_error::lock_error std::_Throw_Cpp_error 75459->75461 75460 7ff72fbe2c0b 75461->75460 75463 7ff72fc00d5c __std_fs_code_page 11 API calls 75462->75463 75464 7ff72fbefb2e 75463->75464 75469->75438 77535 7ff72f9d16d0 77536 7ff72f9d0450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 77535->77536 77537 7ff72f9d1718 77536->77537 77538 7ff72f9d0450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 77537->77538 77539 7ff72f9d1742 77538->77539 77540 7ff72f9d0450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 77539->77540 77541 7ff72f9d176c 77540->77541 77542 7ff72f9d0450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 77541->77542 77543 7ff72f9d17a8 77542->77543 77544 7ff72f9d11a0 _Mpunct 51 API calls 77543->77544 77545 7ff72f9d1942 77544->77545 77546 7ff72f9d05d0 59 API calls 77545->77546 77547 7ff72f9d1970 77546->77547 77672 7ff72fb7e070 77547->77672 77549 7ff72f9d199c 77680 7ff72fa01780 77549->77680 77551 7ff72f9d19ca 77686 7ff72fa6f5c0 77551->77686 77555 7ff72f9d19f7 77696 7ff72fb94db0 77555->77696 77557 7ff72f9d1a4a 77558 7ff72f9d11a0 _Mpunct 51 API calls 77557->77558 77559 7ff72f9d1b83 77558->77559 77560 7ff72fa198a0 70 API calls 77559->77560 77561 7ff72f9d1ba0 allocator 77560->77561 77562 7ff72f9d11a0 _Mpunct 51 API calls 77561->77562 77563 7ff72f9d1bd5 UnDecorator::getVbTableType 77562->77563 77564 7ff72f9d10b0 51 API calls 77563->77564 77565 7ff72f9d1c09 allocator 77564->77565 77566 7ff72f9d1c3b CreateEventW 77565->77566 77567 7ff72f9d1c67 UnDecorator::getVbTableType 77566->77567 77699 7ff72f9d97a0 GetDesktopWindow EnumChildWindows 77567->77699 77569 7ff72f9d1c75 77570 7ff72fbe2bd0 std::_Facet_Register 4 API calls 77569->77570 77571 7ff72f9d1c80 77570->77571 77573 7ff72f9d1c9f 77571->77573 77821 7ff72fa6c0b0 73 API calls 4 library calls 77571->77821 77574 7ff72fbe2bd0 std::_Facet_Register 4 API calls 77573->77574 77575 7ff72f9d1cda 77574->77575 77576 7ff72f9d1cf3 77575->77576 77822 7ff72fa740f0 49 API calls 77575->77822 77700 7ff72fa6e000 77576->77700 77580 7ff72fbe2bd0 std::_Facet_Register 4 API calls 77581 7ff72f9d1d43 77580->77581 77582 7ff72f9d1d62 77581->77582 77707 7ff72fa70320 77581->77707 77584 7ff72fb93e60 50 API calls 77582->77584 77585 7ff72f9d1da4 77584->77585 77710 7ff72f9e4410 77585->77710 77587 7ff72f9d1db1 77727 7ff72f9d5950 77587->77727 77673 7ff72fb7e0a5 77672->77673 77674 7ff72fb7e0db CoInitializeEx 77673->77674 77675 7ff72fb7e0f3 77674->77675 77679 7ff72fb7e0f1 77674->77679 77838 7ff72fa39be0 CoCreateInstance 77675->77838 77677 7ff72fb7e11b 77677->77679 77839 7ff72fb7e460 77677->77839 77679->77549 77681 7ff72fa017b3 77680->77681 77682 7ff72f9d0510 66 API calls 77681->77682 77683 7ff72fa017c5 77682->77683 77915 7ff72fa01a20 77683->77915 77685 7ff72fa017d7 UnDecorator::getVbTableType 77685->77551 78113 7ff72fbaaf60 77686->78113 77688 7ff72fa6f5d6 78118 7ff72fa6f480 77688->78118 77691 7ff72fa79690 78146 7ff72fa05030 77691->78146 77694 7ff72fa05030 49 API calls 77695 7ff72fa796b8 77694->77695 77695->77555 77697 7ff72f9d0450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 77696->77697 77698 7ff72fb94ddc 77697->77698 77698->77557 77699->77569 78170 7ff72fa6ad20 77700->78170 77703 7ff72fa6cd80 47 API calls 77704 7ff72fa6e04e 77703->77704 77705 7ff72f9d4e10 47 API calls 77704->77705 77706 7ff72f9d1d38 77705->77706 77706->77580 78183 7ff72fa717f0 77707->78183 77711 7ff72fb93e60 50 API calls 77710->77711 77712 7ff72f9e4421 Concurrency::details::_Scheduler::_Scheduler 77711->77712 77713 7ff72f9d0510 66 API calls 77712->77713 77714 7ff72f9e447f 77713->77714 78196 7ff72fb93f40 77714->78196 77716 7ff72f9e44a9 Concurrency::details::_Scheduler::_Scheduler UnDecorator::getVbTableType 77717 7ff72f9d0510 66 API calls 77716->77717 77718 7ff72f9e4517 77717->77718 77719 7ff72fb93f40 55 API calls 77718->77719 77720 7ff72f9e4547 UnDecorator::getVbTableType 77719->77720 78217 7ff72fb942a0 77720->78217 77722 7ff72f9e4562 Concurrency::details::_Scheduler::_Scheduler 77723 7ff72f9d0510 66 API calls 77722->77723 77724 7ff72f9e45d1 77723->77724 77725 7ff72fb93f40 55 API calls 77724->77725 77726 7ff72f9e4601 UnDecorator::getVbTableType 77725->77726 77726->77587 77728 7ff72f9da780 57 API calls 77727->77728 77729 7ff72f9d5975 77728->77729 78229 7ff72f9d0480 77729->78229 77821->77573 77822->77576 77838->77677 77840 7ff72f9d11a0 _Mpunct 51 API calls 77839->77840 77841 7ff72fb7e49d 77840->77841 77842 7ff72fa198a0 70 API calls 77841->77842 77843 7ff72fb7e4b7 77842->77843 77844 7ff72f9d11a0 _Mpunct 51 API calls 77843->77844 77845 7ff72fb7e4dc 77844->77845 77846 7ff72fa198a0 70 API calls 77845->77846 77847 7ff72fb7e4f6 allocator Concurrency::details::HardwareAffinity::operator!= shared_ptr 77846->77847 77848 7ff72fb7e5e9 UnDecorator::getVbTableType 77847->77848 77881 7ff72fb792b0 77847->77881 77848->77679 77850 7ff72fb7e7ca allocator shared_ptr 77851 7ff72fb792b0 3 API calls 77850->77851 77856 7ff72fb7e830 allocator shared_ptr 77851->77856 77852 7ff72fb7ebfd 77896 7ff72fa37300 SysFreeString 77852->77896 77854 7ff72fb7ec07 77897 7ff72fa37300 SysFreeString 77854->77897 77856->77852 77857 7ff72f9d0450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 77856->77857 77858 7ff72fb7e8f6 77857->77858 77859 7ff72fa18e90 70 API calls 77858->77859 77860 7ff72fb7e913 allocator 77859->77860 77861 7ff72fb7e950 SysStringLen 77860->77861 77862 7ff72fb7e96a allocator 77861->77862 77889 7ff72fa049e0 77862->77889 77865 7ff72fa66bb0 allocator 2 API calls 77866 7ff72fb7e9d7 77865->77866 77867 7ff72f9d0450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 77866->77867 77871 7ff72fb7ead5 UnDecorator::getVbTableType 77866->77871 77868 7ff72fb7ea04 77867->77868 77869 7ff72fa18e90 70 API calls 77868->77869 77870 7ff72fb7ea21 allocator 77869->77870 77873 7ff72fb7ea5e SysStringLen 77870->77873 77871->77852 77872 7ff72fb7eb7c 77871->77872 77894 7ff72fa37300 SysFreeString 77872->77894 77874 7ff72fb7ea78 allocator 77873->77874 77876 7ff72fa049e0 59 API calls 77874->77876 77877 7ff72fb7ea9d 77876->77877 77879 7ff72fa66bb0 allocator 2 API calls 77877->77879 77878 7ff72fb7eba3 77895 7ff72fa37300 SysFreeString 77878->77895 77879->77871 77882 7ff72fb792c4 77881->77882 77883 7ff72fb792ce 77881->77883 77898 7ff72f9d8370 RtlPcToFileHeader RaiseException std::_Throw_Cpp_error atomic 77882->77898 77885 7ff72fb792d6 77883->77885 77886 7ff72fb792e4 SysAllocStringLen 77883->77886 77885->77850 77887 7ff72fb79302 List 77886->77887 77887->77885 77899 7ff72f9d8370 RtlPcToFileHeader RaiseException std::_Throw_Cpp_error atomic 77887->77899 77890 7ff72f9da5a0 57 API calls 77889->77890 77891 7ff72fa049f8 77890->77891 77900 7ff72fa04880 77891->77900 77894->77878 77895->77848 77896->77854 77897->77848 77898->77883 77899->77885 77901 7ff72fa04898 77900->77901 77901->77901 77903 7ff72fa048d8 77901->77903 77912 7ff72f9d8370 RtlPcToFileHeader RaiseException std::_Throw_Cpp_error atomic 77901->77912 77904 7ff72fa048f1 77903->77904 77913 7ff72f9d8370 RtlPcToFileHeader RaiseException std::_Throw_Cpp_error atomic 77903->77913 77906 7ff72fa04927 UnDecorator::getVbTableType 77904->77906 77914 7ff72f9dea20 RtlPcToFileHeader RaiseException strrchr 77904->77914 77908 7ff72f9dc0d0 Concurrency::task_continuation_context::task_continuation_context 2 API calls 77906->77908 77909 7ff72fa04945 77908->77909 77910 7ff72f9f0d40 UnDecorator::getVbTableType 47 API calls 77909->77910 77911 7ff72fa0496d 77910->77911 77911->77865 77912->77901 77913->77904 77914->77906 77916 7ff72fa01a63 77915->77916 77917 7ff72fa01a38 77915->77917 77916->77685 77918 7ff72fbe2bd0 std::_Facet_Register 4 API calls 77917->77918 77919 7ff72fa01a42 77918->77919 77919->77916 77921 7ff72fa809e0 77919->77921 77922 7ff72fa80a0f 77921->77922 77923 7ff72f9d0450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 77922->77923 77924 7ff72fa80a6f 77923->77924 77925 7ff72f9d0450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 77924->77925 77926 7ff72fa80a93 SysAllocString 77925->77926 77927 7ff72f9d13f0 49 API calls 77926->77927 77928 7ff72fa80b0f 77927->77928 78097 7ff72fa80820 77928->78097 77930 7ff72fa80b24 77931 7ff72f9d11a0 _Mpunct 51 API calls 77930->77931 77932 7ff72fa80b68 77931->77932 77933 7ff72fa198a0 70 API calls 77932->77933 77934 7ff72fa80b7c allocator 77933->77934 77935 7ff72f9d11a0 _Mpunct 51 API calls 77934->77935 77936 7ff72fa80ba5 UnDecorator::getVbTableType 77935->77936 77937 7ff72f9d11a0 _Mpunct 51 API calls 77936->77937 77938 7ff72fa80bd5 77937->77938 77939 7ff72fa198a0 70 API calls 77938->77939 77940 7ff72fa80bf2 allocator 77939->77940 77941 7ff72f9d11a0 _Mpunct 51 API calls 77940->77941 77942 7ff72fa80c27 UnDecorator::getVbTableType 77941->77942 77943 7ff72f9d11a0 _Mpunct 51 API calls 77942->77943 77944 7ff72fa80c5a 77943->77944 77945 7ff72fa198a0 70 API calls 77944->77945 77946 7ff72fa80c77 allocator 77945->77946 77947 7ff72f9d11a0 _Mpunct 51 API calls 77946->77947 77948 7ff72fa80cac UnDecorator::getVbTableType 77947->77948 77949 7ff72f9d11a0 _Mpunct 51 API calls 77948->77949 77950 7ff72fa80cdf 77949->77950 77951 7ff72fa198a0 70 API calls 77950->77951 77952 7ff72fa80cfc allocator 77951->77952 77953 7ff72f9d11a0 _Mpunct 51 API calls 77952->77953 77954 7ff72fa80d31 UnDecorator::getVbTableType 77953->77954 77955 7ff72f9d11a0 _Mpunct 51 API calls 77954->77955 77956 7ff72fa80d64 77955->77956 77957 7ff72fa198a0 70 API calls 77956->77957 77958 7ff72fa80d81 allocator 77957->77958 77959 7ff72f9d11a0 _Mpunct 51 API calls 77958->77959 77960 7ff72fa80db6 UnDecorator::getVbTableType 77959->77960 77961 7ff72f9d11a0 _Mpunct 51 API calls 77960->77961 77962 7ff72fa80de9 77961->77962 77963 7ff72fa198a0 70 API calls 77962->77963 77964 7ff72fa80e06 allocator 77963->77964 77965 7ff72f9d11a0 _Mpunct 51 API calls 77964->77965 77966 7ff72fa80e3b UnDecorator::getVbTableType 77965->77966 77967 7ff72f9d11a0 _Mpunct 51 API calls 77966->77967 77968 7ff72fa80e6e 77967->77968 77969 7ff72fa198a0 70 API calls 77968->77969 77970 7ff72fa80e8b allocator 77969->77970 77971 7ff72f9d11a0 _Mpunct 51 API calls 77970->77971 77972 7ff72fa80ec0 UnDecorator::getVbTableType 77971->77972 77973 7ff72f9d11a0 _Mpunct 51 API calls 77972->77973 77974 7ff72fa80ef3 77973->77974 77975 7ff72fa198a0 70 API calls 77974->77975 77976 7ff72fa80f10 allocator 77975->77976 77977 7ff72f9d11a0 _Mpunct 51 API calls 77976->77977 77978 7ff72fa80f45 UnDecorator::getVbTableType 77977->77978 77979 7ff72f9d11a0 _Mpunct 51 API calls 77978->77979 77980 7ff72fa80f78 77979->77980 77981 7ff72fa198a0 70 API calls 77980->77981 77982 7ff72fa80f95 allocator 77981->77982 77983 7ff72f9d11a0 _Mpunct 51 API calls 77982->77983 77984 7ff72fa80fca UnDecorator::getVbTableType 77983->77984 77985 7ff72f9d11a0 _Mpunct 51 API calls 77984->77985 77986 7ff72fa80ffd 77985->77986 77987 7ff72fa198a0 70 API calls 77986->77987 77988 7ff72fa8101a allocator 77987->77988 77989 7ff72f9d11a0 _Mpunct 51 API calls 77988->77989 77990 7ff72fa8104f UnDecorator::getVbTableType 77989->77990 77991 7ff72f9d10b0 51 API calls 77990->77991 77992 7ff72fa81083 77991->77992 77993 7ff72fa810a0 allocator 77992->77993 77994 7ff72f9d11a0 _Mpunct 51 API calls 77993->77994 77995 7ff72fa810d5 77994->77995 77996 7ff72f9d10b0 51 API calls 77995->77996 77997 7ff72fa81136 allocator 77996->77997 77998 7ff72f9d11a0 _Mpunct 51 API calls 77997->77998 77999 7ff72fa81188 77998->77999 78000 7ff72f9d56a0 51 API calls 77999->78000 78001 7ff72fa811b5 78000->78001 78100 7ff72f9d5040 47 API calls 2 library calls 78001->78100 78003 7ff72fa811c5 78004 7ff72f9d3c10 shared_ptr 47 API calls 78003->78004 78005 7ff72fa811d3 UnDecorator::getVbTableType 78004->78005 78006 7ff72f9d3c10 shared_ptr 47 API calls 78005->78006 78007 7ff72fa811ef UnDecorator::getVbTableType 78006->78007 78008 7ff72f9d10b0 51 API calls 78007->78008 78009 7ff72fa81223 allocator 78008->78009 78010 7ff72f9d11a0 _Mpunct 51 API calls 78009->78010 78011 7ff72fa81275 78010->78011 78012 7ff72f9d10b0 51 API calls 78011->78012 78013 7ff72fa812d6 allocator 78012->78013 78014 7ff72f9d11a0 _Mpunct 51 API calls 78013->78014 78015 7ff72fa81328 78014->78015 78016 7ff72f9d56a0 51 API calls 78015->78016 78017 7ff72fa81355 78016->78017 78101 7ff72f9d5040 47 API calls 2 library calls 78017->78101 78019 7ff72fa81365 78020 7ff72f9d3c10 shared_ptr 47 API calls 78019->78020 78021 7ff72fa81373 UnDecorator::getVbTableType 78020->78021 78022 7ff72f9d3c10 shared_ptr 47 API calls 78021->78022 78023 7ff72fa8138f UnDecorator::getVbTableType 78022->78023 78024 7ff72f9d10b0 51 API calls 78023->78024 78025 7ff72fa813c3 allocator 78024->78025 78026 7ff72f9d11a0 _Mpunct 51 API calls 78025->78026 78027 7ff72fa81415 78026->78027 78028 7ff72f9d10b0 51 API calls 78027->78028 78106 7ff72fa1a810 78097->78106 78100->78003 78101->78019 78107 7ff72fa1a832 Concurrency::details::WorkQueue::IsStructuredEmpty std::ios_base::failure::failure shared_ptr 78106->78107 78110 7ff72fa1a010 78107->78110 78109 7ff72fa1a86d 78109->77930 78111 7ff72f9fb140 allocator 49 API calls 78110->78111 78112 7ff72fa1a02d shared_ptr 78111->78112 78112->78109 78122 7ff72fb9bef0 78113->78122 78115 7ff72fbaaf9e memcpy_s 78116 7ff72fbab002 WlanAllocateMemory 78115->78116 78117 7ff72fbab02b memcpy_s 78116->78117 78117->77688 78119 7ff72fa6f496 78118->78119 78120 7ff72fa6f4db CoInitializeEx CoInitializeSecurity CoCreateInstance IcmpCreateFile 78119->78120 78121 7ff72f9d19e0 78120->78121 78121->77691 78125 7ff72fb9bb40 78122->78125 78126 7ff72fb9bb71 78125->78126 78129 7ff72fb9d9a0 78126->78129 78128 7ff72fb9bb7c 78128->78115 78130 7ff72fb9d9b3 Concurrency::details::WorkQueue::IsStructuredEmpty _Mpunct 78129->78130 78133 7ff72fb96250 78130->78133 78132 7ff72fb9d9ea Concurrency::task_continuation_context::task_continuation_context 78132->78128 78136 7ff72fb9f010 78133->78136 78135 7ff72fb96268 type_info::_name_internal_method 78135->78132 78141 7ff72fb98170 78136->78141 78139 7ff72f9caef0 allocator 49 API calls 78140 7ff72fb9f030 78139->78140 78140->78135 78142 7ff72fb981a3 78141->78142 78143 7ff72fb9819e 78141->78143 78142->78139 78145 7ff72f9e2260 RtlPcToFileHeader RaiseException stdext::threads::lock_error::lock_error std::_Throw_Cpp_error 78143->78145 78145->78142 78149 7ff72fa04a20 78146->78149 78150 7ff72fa04a51 78149->78150 78153 7ff72fa06da0 78150->78153 78152 7ff72fa04a5c 78152->77694 78154 7ff72fa06db3 Concurrency::details::WorkQueue::IsStructuredEmpty _Mpunct 78153->78154 78157 7ff72fa027d0 78154->78157 78156 7ff72fa06dea Concurrency::task_continuation_context::task_continuation_context 78156->78152 78160 7ff72fa080e0 78157->78160 78159 7ff72fa027e8 type_info::_name_internal_method 78159->78156 78165 7ff72fa037a0 78160->78165 78163 7ff72f9caef0 allocator 49 API calls 78164 7ff72fa08100 78163->78164 78164->78159 78166 7ff72fa037d3 78165->78166 78167 7ff72fa037ce 78165->78167 78166->78163 78169 7ff72f9e2260 RtlPcToFileHeader RaiseException stdext::threads::lock_error::lock_error std::_Throw_Cpp_error 78167->78169 78169->78166 78171 7ff72fa6ad3d shared_ptr 78170->78171 78174 7ff72fa6b530 78171->78174 78173 7ff72fa6ad65 78173->77703 78175 7ff72fa6b550 shared_ptr 78174->78175 78176 7ff72f9cfc90 4 API calls 78175->78176 78177 7ff72fa6b578 allocator 78176->78177 78178 7ff72fbefc38 52 API calls 78177->78178 78179 7ff72fa6b5c0 78178->78179 78180 7ff72fa6b5d3 type_info::_name_internal_method 78179->78180 78182 7ff72fbc1c68 51 API calls std::_Throw_Cpp_error 78179->78182 78180->78173 78182->78180 78190 7ff72fa71860 6 API calls 78183->78190 78185 7ff72fa71808 78186 7ff72fa71860 9 API calls 78185->78186 78187 7ff72fa71820 78186->78187 78188 7ff72fa71860 9 API calls 78187->78188 78189 7ff72fa70421 78188->78189 78189->77582 78194 7ff72fc13ad0 78190->78194 78193 7ff72fa71940 78193->78185 78195 7ff72fa71908 GlobalUnlock CreateStreamOnHGlobal GetLastError 78194->78195 78195->78193 78198 7ff72fb93f7f 78196->78198 78197 7ff72fb94281 78197->77716 78198->78197 78199 7ff72fb93fb7 78198->78199 78200 7ff72fb94109 78198->78200 78201 7ff72fbe2bd0 std::_Facet_Register 4 API calls 78199->78201 78202 7ff72fbe2bd0 std::_Facet_Register 4 API calls 78200->78202 78204 7ff72fb93fd7 78201->78204 78205 7ff72fb94129 78202->78205 78203 7ff72fb941a9 78227 7ff72fa51f20 51 API calls shared_ptr 78203->78227 78209 7ff72fb94045 78204->78209 78223 7ff72fb93170 49 API calls Concurrency::details::SchedulerBase::GetPolicy 78204->78223 78205->78203 78226 7ff72fb93170 49 API calls Concurrency::details::SchedulerBase::GetPolicy 78205->78226 78224 7ff72fb949a0 51 API calls shared_ptr 78209->78224 78210 7ff72fb941eb allocator 78211 7ff72fb941f9 AppendMenuW 78210->78211 78213 7ff72fb94103 78211->78213 78228 7ff72fb93010 51 API calls Concurrency::details::WorkQueue::IsStructuredEmpty 78213->78228 78215 7ff72fb940f5 78225 7ff72fb94340 3 API calls 6 library calls 78215->78225 78218 7ff72fb942c6 78217->78218 78219 7ff72f9d0510 66 API calls 78218->78219 78220 7ff72fb942f0 78219->78220 78221 7ff72fb93f40 55 API calls 78220->78221 78222 7ff72fb94322 UnDecorator::getVbTableType 78221->78222 78222->77722 78223->78209 78224->78215 78225->78213 78226->78203 78227->78210 78228->78197 78230 7ff72f9d03d0 2 API calls 78229->78230 78462 7ff72f9cd5f0 78463 7ff72f9cd608 allocator _aligned_msize type_info::_name_internal_method shared_ptr 78462->78463 78468 7ff72f9cfba0 78463->78468 78467 7ff72f9cd659 78473 7ff72f9dafb0 78468->78473 78492 7ff72f9db130 78468->78492 78469 7ff72f9cd654 78472 7ff72fbc1a54 60 API calls std::_Throw_Cpp_error 78469->78472 78472->78467 78474 7ff72f9d11a0 _Mpunct 51 API calls 78473->78474 78475 7ff72f9dafda 78474->78475 78476 7ff72fa198a0 70 API calls 78475->78476 78477 7ff72f9dafee allocator 78476->78477 78478 7ff72f9d11a0 _Mpunct 51 API calls 78477->78478 78479 7ff72f9db014 UnDecorator::getVbTableType 78478->78479 78480 7ff72f9d10b0 51 API calls 78479->78480 78481 7ff72f9db03c allocator 78480->78481 78482 7ff72f9db05f OpenEventW 78481->78482 78484 7ff72f9db07e UnDecorator::getVbTableType 78482->78484 78567 7ff72fb9f160 78484->78567 78784 7ff72fba0140 78484->78784 78487 7ff72f9db0a8 78488 7ff72f9db0b0 CloseHandle 78487->78488 78489 7ff72f9db0bc 78487->78489 78488->78489 78490 7ff72f9d3c10 shared_ptr 47 API calls 78489->78490 78491 7ff72f9db0c6 78490->78491 78491->78469 78493 7ff72f9d11a0 _Mpunct 51 API calls 78492->78493 78494 7ff72f9db161 78493->78494 78495 7ff72fa198a0 70 API calls 78494->78495 78496 7ff72f9db17b 78495->78496 78497 7ff72f9d0450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 78496->78497 78498 7ff72f9db1e0 78497->78498 78499 7ff72fa18e90 70 API calls 78498->78499 78500 7ff72f9db1fd allocator UnDecorator::getVbTableType 78499->78500 78501 7ff72f9db227 RegisterClassExW 78500->78501 78502 7ff72f9db24d 78501->78502 78510 7ff72f9db23d UnDecorator::getVbTableType 78501->78510 78503 7ff72f9d0450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 78502->78503 78504 7ff72f9db283 78503->78504 78505 7ff72fa18e90 70 API calls 78504->78505 78506 7ff72f9db2a0 allocator 78505->78506 78507 7ff72f9db2b5 CreateWindowExW 78506->78507 78508 7ff72f9db33a UnDecorator::getVbTableType 78507->78508 78509 7ff72f9db35a ShowWindow 78508->78509 78508->78510 78511 7ff72f9db384 78509->78511 78510->78469 78512 7ff72f9ec710 51 API calls 78511->78512 78513 7ff72f9db3bb 78512->78513 78514 7ff72f9ec1b0 51 API calls 78513->78514 78515 7ff72f9db3cd 78514->78515 78516 7ff72f9d11a0 _Mpunct 51 API calls 78515->78516 78517 7ff72f9db40b 78516->78517 78518 7ff72fa198a0 70 API calls 78517->78518 78519 7ff72f9db428 78518->78519 78520 7ff72f9d11a0 _Mpunct 51 API calls 78519->78520 78521 7ff72f9db44d 78520->78521 78522 7ff72fa198a0 70 API calls 78521->78522 78523 7ff72f9db46a 78522->78523 78524 7ff72f9d0450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 78523->78524 78525 7ff72f9db490 78524->78525 78526 7ff72fa18e90 70 API calls 78525->78526 78527 7ff72f9db4ad 78526->78527 78528 7ff72f9d0450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 78527->78528 78529 7ff72f9db4fa 78528->78529 78530 7ff72fa18e90 70 API calls 78529->78530 78531 7ff72f9db517 78530->78531 78532 7ff72f9d5950 59 API calls 78531->78532 78533 7ff72f9db54b 78532->78533 80315 7ff72f9d5880 78533->80315 78535 7ff72f9d50c0 task 51 API calls 78536 7ff72f9db5e7 GetForegroundWindow 78535->78536 78539 7ff72f9db62f Concurrency::details::WorkQueue::IsStructuredEmpty 78536->78539 78537 7ff72f9db602 GetWindowTextW 78537->78539 78538 7ff72f9dbfd8 UnDecorator::getVbTableType 78544 7ff72f9d3c10 shared_ptr 47 API calls 78538->78544 78539->78537 78540 7ff72f9db662 PeekMessageW 78539->78540 78541 7ff72f9db692 TranslateMessage DispatchMessageW 78540->78541 78542 7ff72f9dbe21 SleepEx 78540->78542 78543 7ff72f9db590 allocator UnDecorator::getVbTableType 78541->78543 78542->78543 78543->78535 78543->78538 78546 7ff72f9d11a0 51 API calls _Mpunct 78543->78546 78549 7ff72fa198a0 70 API calls 78543->78549 78550 7ff72f9dbe5e OpenEventW 78543->78550 78551 7ff72f9dbe49 78543->78551 78556 7ff72f9d0510 66 API calls 78543->78556 78562 7ff72f9d0450 49 API calls Concurrency::details::SchedulerBase::GetPolicy 78543->78562 78563 7ff72fa5d350 88 API calls 78543->78563 78564 7ff72f9ed500 74 API calls 78543->78564 78565 7ff72fa18e90 70 API calls 78543->78565 78566 7ff72f9e3b30 106 API calls 78543->78566 80324 7ff72fa55130 keybd_event keybd_event 78543->80324 80325 7ff72fa3ab70 212 API calls 2 library calls 78543->80325 78545 7ff72f9dc021 78544->78545 78548 7ff72f9d3c10 shared_ptr 47 API calls 78545->78548 78546->78543 78548->78510 78549->78543 78550->78543 78552 7ff72f9dbe82 WaitForSingleObject 78550->78552 78551->78543 78552->78543 78558 7ff72f9dbe9a allocator UnDecorator::getVbTableType 78552->78558 78554 7ff72fa198a0 70 API calls 78554->78558 78555 7ff72f9d11a0 51 API calls _Mpunct 78555->78558 78556->78543 78557 7ff72f9d10b0 51 API calls 78557->78558 78558->78554 78558->78555 78558->78557 78559 7ff72fa6db90 80 API calls 78558->78559 78560 7ff72f9dbfb8 CloseHandle 78559->78560 78561 7ff72f9d3c10 shared_ptr 47 API calls 78560->78561 78561->78551 78562->78543 78563->78543 78564->78543 78565->78543 78566->78543 78568 7ff72f9d0f30 _Mpunct 51 API calls 78567->78568 78569 7ff72fb9f18e 78568->78569 79001 7ff72fa19aa0 78569->79001 78572 7ff72f9d0f30 _Mpunct 51 API calls 78573 7ff72fb9f1d0 78572->78573 78574 7ff72fa19aa0 88 API calls 78573->78574 78575 7ff72fb9f1ed 78574->78575 78576 7ff72f9d0f30 _Mpunct 51 API calls 78575->78576 78577 7ff72fb9f212 78576->78577 78578 7ff72fa19aa0 88 API calls 78577->78578 78579 7ff72fb9f22f 78578->78579 78580 7ff72f9d0f30 _Mpunct 51 API calls 78579->78580 78581 7ff72fb9f254 78580->78581 78582 7ff72fa19aa0 88 API calls 78581->78582 78583 7ff72fb9f271 78582->78583 78584 7ff72f9d0f30 _Mpunct 51 API calls 78583->78584 78585 7ff72fb9f296 78584->78585 78586 7ff72fa19aa0 88 API calls 78585->78586 78587 7ff72fb9f2b3 78586->78587 79031 7ff72f9d0e90 78587->79031 78598 7ff72f9f9140 shared_ptr 47 API calls 78599 7ff72fb9f39b 78598->78599 78600 7ff72f9f9140 shared_ptr 47 API calls 78599->78600 78601 7ff72fb9f3a9 78600->78601 78602 7ff72f9d3be0 std::ios_base::failure::failure 47 API calls 78601->78602 78603 7ff72fb9f3b7 78602->78603 79086 7ff72fba7830 78603->79086 78785 7ff72f9d0f30 _Mpunct 51 API calls 78784->78785 78786 7ff72fba016e 78785->78786 78787 7ff72fa19aa0 88 API calls 78786->78787 78788 7ff72fba018b 78787->78788 78789 7ff72f9d0f30 _Mpunct 51 API calls 78788->78789 78790 7ff72fba01b0 78789->78790 78791 7ff72fa19aa0 88 API calls 78790->78791 78792 7ff72fba01cd 78791->78792 78793 7ff72f9d0f30 _Mpunct 51 API calls 78792->78793 78794 7ff72fba01f2 78793->78794 78795 7ff72fa19aa0 88 API calls 78794->78795 78796 7ff72fba020f 78795->78796 78797 7ff72f9d0f30 _Mpunct 51 API calls 78796->78797 78798 7ff72fba0234 78797->78798 78799 7ff72fa19aa0 88 API calls 78798->78799 78800 7ff72fba0251 78799->78800 78801 7ff72f9d0f30 _Mpunct 51 API calls 78800->78801 78802 7ff72fba0276 78801->78802 78803 7ff72fa19aa0 88 API calls 78802->78803 78804 7ff72fba0293 78803->78804 78805 7ff72f9d0e90 std::ios_base::failure::failure 51 API calls 78804->78805 78806 7ff72fba02b9 78805->78806 78807 7ff72fa19580 54 API calls 78806->78807 78808 7ff72fba02d6 78807->78808 78809 7ff72fa5f8f0 54 API calls 78808->78809 78810 7ff72fba0306 78809->78810 78811 7ff72fb9caf0 52 API calls 78810->78811 78812 7ff72fba0338 78811->78812 78813 7ff72fa588f0 51 API calls 78812->78813 78814 7ff72fba036d 78813->78814 78815 7ff72f9f9140 shared_ptr 47 API calls 78814->78815 78816 7ff72fba037b 78815->78816 78817 7ff72f9f9140 shared_ptr 47 API calls 78816->78817 78818 7ff72fba0389 78817->78818 78819 7ff72f9d3be0 std::ios_base::failure::failure 47 API calls 78818->78819 78820 7ff72fba0397 78819->78820 78821 7ff72fba7830 125 API calls 78820->78821 78822 7ff72fba03b8 78821->78822 78823 7ff72f9d0e90 std::ios_base::failure::failure 51 API calls 78822->78823 78824 7ff72fba03de 78823->78824 78825 7ff72fa19580 54 API calls 78824->78825 78826 7ff72fba03fb 78825->78826 78827 7ff72fa5f8f0 54 API calls 78826->78827 78828 7ff72fba042b 78827->78828 78829 7ff72fa588f0 51 API calls 78828->78829 78830 7ff72fba0449 78829->78830 78831 7ff72fa4bf80 75 API calls 78830->78831 78832 7ff72fba046e 78831->78832 78833 7ff72f9f9140 shared_ptr 47 API calls 78832->78833 78834 7ff72fba047f 78833->78834 78835 7ff72f9f9140 shared_ptr 47 API calls 78834->78835 78836 7ff72fba048d 78835->78836 78837 7ff72f9d3be0 std::ios_base::failure::failure 47 API calls 78836->78837 78838 7ff72fba049b 78837->78838 78839 7ff72fba058f 78838->78839 78840 7ff72f9d0e90 std::ios_base::failure::failure 51 API calls 78838->78840 78841 7ff72f9d0e90 std::ios_base::failure::failure 51 API calls 78839->78841 78842 7ff72fba04cd 78840->78842 78843 7ff72fba05b5 78841->78843 78844 7ff72fa19580 54 API calls 78842->78844 78845 7ff72fa19580 54 API calls 78843->78845 78846 7ff72fba04ea 78844->78846 78847 7ff72fba05d2 78845->78847 78848 7ff72fa5f8f0 54 API calls 78846->78848 78849 7ff72fa5f8f0 54 API calls 78847->78849 78850 7ff72fba051a 78848->78850 78851 7ff72fba0602 78849->78851 78852 7ff72fa588f0 51 API calls 78850->78852 78853 7ff72fa588f0 51 API calls 78851->78853 78854 7ff72fba0538 78852->78854 78855 7ff72fba0620 78853->78855 80307 7ff72fba7d20 51 API calls shared_ptr 78854->80307 78857 7ff72fa4bf80 75 API calls 78855->78857 78858 7ff72fba0645 78857->78858 78861 7ff72f9f9140 shared_ptr 47 API calls 78858->78861 78859 7ff72fba0565 78860 7ff72f9f9140 shared_ptr 47 API calls 78859->78860 78862 7ff72fba0573 78860->78862 78863 7ff72fba0656 78861->78863 78864 7ff72f9f9140 shared_ptr 47 API calls 78862->78864 78865 7ff72f9f9140 shared_ptr 47 API calls 78863->78865 78866 7ff72fba0581 78864->78866 78867 7ff72fba0664 78865->78867 78868 7ff72f9d3be0 std::ios_base::failure::failure 47 API calls 78866->78868 78869 7ff72f9d3be0 std::ios_base::failure::failure 47 API calls 78867->78869 78868->78839 78870 7ff72fba0672 78869->78870 78871 7ff72f9d0e90 std::ios_base::failure::failure 51 API calls 78870->78871 78873 7ff72fba0766 HandleT Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock 78870->78873 78872 7ff72fba06a4 78871->78872 78874 7ff72fa19580 54 API calls 78872->78874 78879 7ff72f9d0e90 std::ios_base::failure::failure 51 API calls 78873->78879 78884 7ff72fba0a6d 78873->78884 78875 7ff72fba06c1 78874->78875 78876 7ff72fa5f8f0 54 API calls 78875->78876 78877 7ff72fba06f1 78876->78877 78878 7ff72fa588f0 51 API calls 78877->78878 78881 7ff72fba070f 78878->78881 78880 7ff72fba07e7 78879->78880 78883 7ff72fa19580 54 API calls 78880->78883 80308 7ff72fba7d20 51 API calls shared_ptr 78881->80308 78887 7ff72fba0804 78883->78887 78885 7ff72f9d11a0 _Mpunct 51 API calls 78884->78885 79000 7ff72fba104d UnDecorator::getVbTableType 78884->79000 78889 7ff72fba0aac 78885->78889 78886 7ff72fba073c 78890 7ff72f9f9140 shared_ptr 47 API calls 78886->78890 78891 7ff72fa5f8f0 54 API calls 78887->78891 78888 7ff72fb9c450 47 API calls 78892 7ff72fba10a9 78888->78892 78893 7ff72fa198a0 70 API calls 78889->78893 78894 7ff72fba074a 78890->78894 78895 7ff72fba0834 78891->78895 78896 7ff72fb9c430 47 API calls 78892->78896 78897 7ff72fba0ac9 78893->78897 78898 7ff72f9f9140 shared_ptr 47 API calls 78894->78898 78899 7ff72fa588f0 51 API calls 78895->78899 78900 7ff72fba10b4 78896->78900 78901 7ff72f9d11a0 _Mpunct 51 API calls 78897->78901 78902 7ff72fba0758 78898->78902 78903 7ff72fba084f 78899->78903 78904 7ff72f9f9140 shared_ptr 47 API calls 78900->78904 78905 7ff72fba0aee 78901->78905 78906 7ff72f9d3be0 std::ios_base::failure::failure 47 API calls 78902->78906 78907 7ff72fa4bf80 75 API calls 78903->78907 78908 7ff72fba10c2 78904->78908 78909 7ff72fa198a0 70 API calls 78905->78909 78906->78873 78910 7ff72fba0874 78907->78910 78911 7ff72f9d3be0 std::ios_base::failure::failure 47 API calls 78908->78911 78913 7ff72fba0b0b 78909->78913 78914 7ff72f9f9140 shared_ptr 47 API calls 78910->78914 78912 7ff72fba10d0 78911->78912 78915 7ff72f9d3be0 std::ios_base::failure::failure 47 API calls 78912->78915 78916 7ff72f9d11a0 _Mpunct 51 API calls 78913->78916 78917 7ff72fba0885 78914->78917 78918 7ff72fba10de 78915->78918 78919 7ff72fba0b30 78916->78919 78920 7ff72f9f9140 shared_ptr 47 API calls 78917->78920 78921 7ff72f9d3be0 std::ios_base::failure::failure 47 API calls 78918->78921 78922 7ff72fa198a0 70 API calls 78919->78922 78923 7ff72fba0893 78920->78923 78924 7ff72fba10ec 78921->78924 78925 7ff72fba0b4d 78922->78925 78926 7ff72f9d3be0 std::ios_base::failure::failure 47 API calls 78923->78926 78927 7ff72f9d3be0 std::ios_base::failure::failure 47 API calls 78924->78927 78928 7ff72f9d11a0 _Mpunct 51 API calls 78925->78928 78929 7ff72fba08a1 78926->78929 78930 7ff72fba10fa 78927->78930 78931 7ff72fba0b72 78928->78931 78929->78884 78932 7ff72f9d0e90 std::ios_base::failure::failure 51 API calls 78929->78932 78933 7ff72f9d3be0 std::ios_base::failure::failure 47 API calls 78930->78933 78934 7ff72fa198a0 70 API calls 78931->78934 78935 7ff72fba08d3 78932->78935 78936 7ff72f9db089 WaitForSingleObject 78933->78936 78939 7ff72fba0b8f 78934->78939 78937 7ff72fa19580 54 API calls 78935->78937 78936->78484 78936->78487 78938 7ff72fba08f0 78937->78938 78940 7ff72fa5f8f0 54 API calls 78938->78940 80310 7ff72fb9b4e0 47 API calls 78939->80310 78941 7ff72fba0920 78940->78941 78943 7ff72fa588f0 51 API calls 78941->78943 78944 7ff72fba093b 78943->78944 78945 7ff72fba7270 144 API calls 78944->78945 78946 7ff72fba0968 78945->78946 78947 7ff72f9f9140 shared_ptr 47 API calls 78946->78947 78948 7ff72fba0976 78947->78948 78949 7ff72f9f9140 shared_ptr 47 API calls 78948->78949 78951 7ff72fba0984 78949->78951 78950 7ff72fba0bdf 80311 7ff72fb9b760 47 API calls 78950->80311 78953 7ff72f9d3be0 std::ios_base::failure::failure 47 API calls 78951->78953 78957 7ff72fba0992 78953->78957 78954 7ff72fba0c42 80312 7ff72fba7e90 51 API calls 78954->80312 78956 7ff72fba0c96 78958 7ff72f9d05d0 59 API calls 78956->78958 80309 7ff72fb9b360 51 API calls 2 library calls 78957->80309 78960 7ff72fba0ca1 78958->78960 78962 7ff72f9d11a0 _Mpunct 51 API calls 78960->78962 78961 7ff72fba0a5f 78963 7ff72fb9c430 47 API calls 78961->78963 78964 7ff72fba0cc6 78962->78964 78963->78884 78965 7ff72fa198a0 70 API calls 78964->78965 78966 7ff72fba0ce0 78965->78966 80313 7ff72fb95480 51 API calls 2 library calls 78966->80313 78968 7ff72fba0cf3 80314 7ff72f9fc650 51 API calls 3 library calls 78968->80314 78970 7ff72fba0d1f Concurrency::details::WorkQueue::IsStructuredEmpty 78971 7ff72f9d04b0 68 API calls 78970->78971 78972 7ff72fba0d54 78971->78972 78973 7ff72f9d0450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 78972->78973 78974 7ff72fba0da1 78973->78974 78975 7ff72fa18e90 70 API calls 78974->78975 78976 7ff72fba0dbe allocator 78975->78976 78977 7ff72f9da250 68 API calls 78976->78977 78978 7ff72fba0e05 UnDecorator::getVbTableType 78977->78978 78979 7ff72f9d3be0 std::ios_base::failure::failure 47 API calls 78978->78979 78980 7ff72fba0e2f 78979->78980 78981 7ff72f9d0450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 78980->78981 78982 7ff72fba0e55 78981->78982 78983 7ff72fa18e90 70 API calls 78982->78983 78984 7ff72fba0e72 78983->78984 78985 7ff72f9d0450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 78984->78985 78986 7ff72fba0ebf 78985->78986 78987 7ff72fa18e90 70 API calls 78986->78987 78988 7ff72fba0edc 78987->78988 78989 7ff72f9d0450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 78988->78989 78990 7ff72fba0f29 78989->78990 79000->78888 79002 7ff72f9d11a0 _Mpunct 51 API calls 79001->79002 79003 7ff72fa19acd 79002->79003 79004 7ff72fa18170 51 API calls 79003->79004 79005 7ff72fa19ae0 79004->79005 79006 7ff72fa185c0 type_info::_name_internal_method 51 API calls 79005->79006 79007 7ff72fa19af6 79006->79007 79234 7ff72fa0cad0 79007->79234 79010 7ff72fa19e60 51 API calls 79011 7ff72fa19b35 79010->79011 79012 7ff72fa18140 type_info::_name_internal_method 51 API calls 79011->79012 79013 7ff72fa19b56 79012->79013 79014 7ff72f9d3c10 shared_ptr 47 API calls 79013->79014 79015 7ff72fa19b64 79014->79015 79016 7ff72f9d3c10 shared_ptr 47 API calls 79015->79016 79017 7ff72fa19b72 Concurrency::details::WorkQueue::IsStructuredEmpty Concurrency::details::HardwareAffinity::operator!= 79016->79017 79018 7ff72fa189d0 51 API calls 79017->79018 79023 7ff72fa19bad shared_ptr 79018->79023 79019 7ff72fa19c64 Concurrency::details::HardwareAffinity::operator!= 79021 7ff72f9d3be0 std::ios_base::failure::failure 47 API calls 79019->79021 79022 7ff72fa19c91 79021->79022 79024 7ff72f9d3c10 shared_ptr 47 API calls 79022->79024 79023->79019 79243 7ff72fa18200 47 API calls 79023->79243 79244 7ff72fa19cd0 51 API calls 2 library calls 79023->79244 79026 7ff72fa19c9f 79024->79026 79027 7ff72f9d3c10 shared_ptr 47 API calls 79026->79027 79028 7ff72fa19cad 79027->79028 79029 7ff72f9d3be0 std::ios_base::failure::failure 47 API calls 79028->79029 79030 7ff72fa19cbb 79029->79030 79030->78572 79032 7ff72f9d0eb2 Concurrency::details::WorkQueue::IsStructuredEmpty Concurrency::cancellation_token::_FromImpl std::ios_base::failure::failure 79031->79032 79302 7ff72f9cb760 79032->79302 79034 7ff72f9d0f16 79035 7ff72fa19580 79034->79035 79039 7ff72fa195ab shared_ptr 79035->79039 79036 7ff72fa18610 54 API calls 79037 7ff72fa19659 79036->79037 79038 7ff72fa1966a 79037->79038 79043 7ff72fa196a7 shared_ptr 79037->79043 79040 7ff72fa17fa0 47 API calls 79038->79040 79039->79036 79041 7ff72fa1968c 79040->79041 79042 7ff72f9d3be0 std::ios_base::failure::failure 47 API calls 79041->79042 79044 7ff72fa1969a 79042->79044 79309 7ff72f9c97a0 51 API calls 4 library calls 79043->79309 79060 7ff72fa5f8f0 79044->79060 79046 7ff72fa1973d shared_ptr 79310 7ff72f9c97a0 51 API calls 4 library calls 79046->79310 79048 7ff72fa197f2 79049 7ff72fa19e60 51 API calls 79048->79049 79050 7ff72fa19810 79049->79050 79051 7ff72f9d3c10 shared_ptr 47 API calls 79050->79051 79052 7ff72fa19855 79051->79052 79053 7ff72f9d3c10 shared_ptr 47 API calls 79052->79053 79054 7ff72fa19863 79053->79054 79055 7ff72f9d3c10 shared_ptr 47 API calls 79054->79055 79056 7ff72fa19871 79055->79056 79057 7ff72fa17fa0 47 API calls 79056->79057 79058 7ff72fa1987c 79057->79058 79059 7ff72f9d3be0 std::ios_base::failure::failure 47 API calls 79058->79059 79059->79044 79311 7ff72fa5ff10 79060->79311 79063 7ff72fb9caf0 79064 7ff72fb9cb23 79063->79064 79065 7ff72fb9cb54 79064->79065 79066 7ff72fb9cb2e 79064->79066 79352 7ff72fa1e140 51 API calls 79065->79352 79351 7ff72fb95250 51 API calls 79066->79351 79069 7ff72fb9cb66 CoTaskMemFree 79071 7ff72fb9cb80 79069->79071 79070 7ff72fb9cb42 79073 7ff72fa588f0 79070->79073 79072 7ff72f9f9140 shared_ptr 47 API calls 79071->79072 79072->79070 79077 7ff72fa58920 Concurrency::details::WorkQueue::IsStructuredEmpty Concurrency::details::HardwareAffinity::operator!= std::_Is_slash_oper::operator 79073->79077 79074 7ff72fa58afb 79354 7ff72f9f7620 79074->79354 79077->79074 79082 7ff72fa58992 Concurrency::details::WorkQueue::IsStructuredEmpty Concurrency::details::HardwareAffinity::operator!= std::_Is_slash_oper::operator 79077->79082 79079 7ff72fa58b26 79080 7ff72f9f9140 shared_ptr 47 API calls 79079->79080 79081 7ff72fa58af1 79080->79081 79081->78598 79353 7ff72fa57ee0 51 API calls 2 library calls 79082->79353 79084 7ff72fa58ac9 79085 7ff72f9f9140 shared_ptr 47 API calls 79084->79085 79085->79081 79087 7ff72fba7856 79086->79087 79088 7ff72fa4bf80 75 API calls 79087->79088 79245 7ff72fa05230 79234->79245 79236 7ff72fa0caf3 79252 7ff72fa0ab10 79236->79252 79238 7ff72fa0cb0b 79239 7ff72f9d3c10 shared_ptr 47 API calls 79238->79239 79240 7ff72fa0cb32 79239->79240 79256 7ff72fa058f0 79240->79256 79242 7ff72fa0cb3d 79242->79010 79243->79023 79244->79023 79246 7ff72f9d3410 std::ios_base::_Init 59 API calls 79245->79246 79247 7ff72fa05259 79246->79247 79248 7ff72fbe2bd0 std::_Facet_Register 4 API calls 79247->79248 79249 7ff72fa052a3 79248->79249 79251 7ff72fa052bc 79249->79251 79261 7ff72fa04f30 87 API calls std::bad_exception::bad_exception 79249->79261 79251->79236 79253 7ff72fa0ab35 Concurrency::details::WorkQueue::IsStructuredEmpty Concurrency::details::HardwareAffinity::operator!= 79252->79253 79262 7ff72fa0ab80 79253->79262 79257 7ff72f9d3c10 shared_ptr 47 API calls 79256->79257 79258 7ff72fa05919 79257->79258 79259 7ff72f9d3be0 std::ios_base::failure::failure 47 API calls 79258->79259 79260 7ff72fa0592a type_info::_name_internal_method 79259->79260 79260->79242 79261->79251 79263 7ff72fa0abae 79262->79263 79264 7ff72f9e2e10 51 API calls 79263->79264 79265 7ff72fa0ac11 79264->79265 79266 7ff72fa0aeab 79265->79266 79271 7ff72fa0ac5c Concurrency::details::HardwareAffinity::operator!= 79265->79271 79267 7ff72f9d3c10 shared_ptr 47 API calls 79266->79267 79268 7ff72fa0aed8 79267->79268 79269 7ff72f9d3c10 shared_ptr 47 API calls 79268->79269 79270 7ff72fa0ab66 79269->79270 79270->79238 79272 7ff72fa0ad28 79271->79272 79279 7ff72fa0ad18 79271->79279 79273 7ff72fa0ad62 Concurrency::details::HardwareAffinity::operator!= 79272->79273 79274 7ff72fa0ad34 79272->79274 79277 7ff72fa0ad87 79273->79277 79278 7ff72fa0ad72 79273->79278 79275 7ff72f9e2d10 type_info::_name_internal_method 51 API calls 79274->79275 79289 7ff72fa0ad5c 79275->79289 79276 7ff72fa0ad23 79280 7ff72fa0ae99 79276->79280 79281 7ff72fa0ae4e 79276->79281 79276->79289 79286 7ff72fa0ad97 79277->79286 79287 7ff72fa0ade5 79277->79287 79283 7ff72f9e2e10 51 API calls 79278->79283 79279->79276 79300 7ff72fa0b9d0 51 API calls 2 library calls 79279->79300 79301 7ff72fa07f30 51 API calls 2 library calls 79280->79301 79285 7ff72f9d10b0 51 API calls 79281->79285 79283->79289 79290 7ff72fa0ae6a 79285->79290 79291 7ff72f9d10b0 51 API calls 79286->79291 79299 7ff72fa07f30 51 API calls 2 library calls 79287->79299 79293 7ff72f9d3c10 shared_ptr 47 API calls 79290->79293 79292 7ff72fa0adb3 79291->79292 79294 7ff72f9d3c10 shared_ptr 47 API calls 79292->79294 79295 7ff72fa0ae82 79293->79295 79297 7ff72fa0adcb 79294->79297 79296 7ff72f9d3c10 shared_ptr 47 API calls 79295->79296 79296->79270 79298 7ff72f9d3c10 shared_ptr 47 API calls 79297->79298 79298->79270 79299->79289 79300->79279 79301->79289 79303 7ff72f9cb787 Concurrency::task_continuation_context::task_continuation_context 79302->79303 79305 7ff72f9cb796 Concurrency::details::WorkQueue::IsStructuredEmpty _Mpunct Concurrency::task_continuation_context::task_continuation_context 79303->79305 79308 7ff72f9e2970 51 API calls Concurrency::task_continuation_context::task_continuation_context 79303->79308 79306 7ff72f9caf90 Concurrency::task_continuation_context::task_continuation_context 49 API calls 79305->79306 79307 7ff72f9cb7d2 _Mpunct Concurrency::task_continuation_context::task_continuation_context type_info::_name_internal_method shared_ptr 79305->79307 79306->79307 79307->79034 79308->79305 79309->79046 79310->79048 79312 7ff72fa5ff3c 79311->79312 79315 7ff72fa57cb0 79312->79315 79320 7ff72fbc7358 79315->79320 79341 7ff72fbfab18 79320->79341 79323 7ff72fbc736a AreFileApisANSI 79324 7ff72fa57ce6 79323->79324 79325 7ff72fa59a70 79324->79325 79329 7ff72fa59a97 std::error_category::equivalent List 79325->79329 79326 7ff72fa59ba8 79327 7ff72f9d3c10 shared_ptr 47 API calls 79326->79327 79328 7ff72fa57d14 79327->79328 79328->79063 79329->79326 79331 7ff72fa59ad6 std::error_category::equivalent allocator 79329->79331 79346 7ff72fa44c30 51 API calls 2 library calls 79329->79346 79347 7ff72fbc7380 MultiByteToWideChar GetLastError 79331->79347 79333 7ff72fa59b1b 79348 7ff72fa3f420 51 API calls 79333->79348 79335 7ff72fa59b2a 79336 7ff72f9ec710 51 API calls 79335->79336 79337 7ff72fa59b43 Concurrency::details::WorkQueue::IsStructuredEmpty std::error_category::equivalent allocator 79336->79337 79349 7ff72fbc7380 MultiByteToWideChar GetLastError 79337->79349 79339 7ff72fa59b99 79350 7ff72fa3f420 51 API calls 79339->79350 79342 7ff72fc009fc __std_fs_code_page 47 API calls 79341->79342 79343 7ff72fbfab21 79342->79343 79344 7ff72fc00e70 __std_fs_code_page 47 API calls 79343->79344 79345 7ff72fbc7361 79344->79345 79345->79323 79345->79324 79346->79331 79347->79333 79348->79335 79349->79339 79350->79326 79351->79070 79352->79069 79353->79084 79355 7ff72f9d10b0 51 API calls 79354->79355 79356 7ff72f9f764a 79355->79356 79357 7ff72fa58cd0 79356->79357 79358 7ff72fa58ceb 79357->79358 79359 7ff72fa58cf2 79358->79359 79361 7ff72fa58d0c Concurrency::details::WorkQueue::IsStructuredEmpty Concurrency::details::HardwareAffinity::operator!= 79358->79361 79375 7ff72fa58640 51 API calls task 79359->79375 79362 7ff72fa58ddd std::_Is_slash_oper::operator 79361->79362 79366 7ff72fa58dc3 79361->79366 79363 7ff72fa58e37 79362->79363 79367 7ff72fa58e04 79362->79367 79364 7ff72fa58e43 79363->79364 79373 7ff72fa58e7a std::_Is_slash_oper::operator 79363->79373 79365 7ff72fa58e31 79364->79365 79378 7ff72fa0b9d0 51 API calls 2 library calls 79364->79378 79370 7ff72f9e2d10 type_info::_name_internal_method 51 API calls 79365->79370 79376 7ff72fa58640 51 API calls task 79366->79376 79377 7ff72fa5a370 51 API calls type_info::_name_internal_method 79367->79377 79372 7ff72fa58d07 79370->79372 79372->79079 79373->79365 79379 7ff72fa0b9d0 51 API calls 2 library calls 79373->79379 79375->79372 79376->79372 79377->79365 79378->79365 79379->79365 80307->78859 80308->78886 80309->78961 80310->78950 80311->78954 80312->78956 80313->78968 80314->78970 80316 7ff72f9da780 57 API calls 80315->80316 80317 7ff72f9d58a5 80316->80317 80318 7ff72f9d0480 2 API calls 80317->80318 80319 7ff72f9d58b2 allocator std::ios_base::good 80318->80319 80320 7ff72f9d85e0 49 API calls 80319->80320 80321 7ff72f9d5914 80320->80321 80322 7ff72f9d0450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 80321->80322 80323 7ff72f9d5923 UnDecorator::getVbTableType 80322->80323 80323->78543 80324->78551 80325->78543 80326 7ff72fa051f0 80329 7ff72fa04ef0 80326->80329 80328 7ff72fa051fc 80332 7ff72fa04e70 80329->80332 80333 7ff72fa04e96 std::bad_exception::bad_exception 80332->80333 80340 7ff72f9d2c70 80333->80340 80341 7ff72fbc13e8 std::_Lockit::_Lockit 6 API calls 80340->80341 80342 7ff72f9d2c94 _Yarn 80341->80342 80343 7ff72f9d2d1b 80342->80343 80344 7ff72f9d2d09 80342->80344 80369 7ff72fbc18e0 51 API calls 2 library calls 80343->80369 80368 7ff72fbc200c 83 API calls std::_Locinfo::_Locinfo_ctor 80344->80368 80347 7ff72f9d2d18 80348 7ff72fa073c0 80347->80348 80370 7ff72f9e0020 80348->80370 80351 7ff72f9d4b10 80393 7ff72fbc2078 80351->80393 80356 7ff72f9d3a50 std::bad_exception::bad_exception 13 API calls 80357 7ff72f9d4b46 80356->80357 80358 7ff72f9d3a50 std::bad_exception::bad_exception 13 API calls 80357->80358 80359 7ff72f9d4b57 80358->80359 80360 7ff72f9d3a50 std::bad_exception::bad_exception 13 API calls 80359->80360 80361 7ff72f9d4b68 80360->80361 80362 7ff72f9d3a50 std::bad_exception::bad_exception 13 API calls 80361->80362 80363 7ff72f9d4b79 80362->80363 80364 7ff72f9d3a50 std::bad_exception::bad_exception 13 API calls 80363->80364 80365 7ff72f9d4b8a 80364->80365 80366 7ff72fbc1460 std::_Lockit::~_Lockit LeaveCriticalSection 80365->80366 80367 7ff72f9d4b97 80366->80367 80367->80328 80369->80347 80373 7ff72fbc2390 80370->80373 80374 7ff72fbfab18 __std_fs_code_page 47 API calls 80373->80374 80375 7ff72fbc23b5 80374->80375 80382 7ff72fbfabac 80375->80382 80381 7ff72f9e003a 80381->80351 80383 7ff72fc009fc __std_fs_code_page 47 API calls 80382->80383 80384 7ff72fbfabb5 80383->80384 80385 7ff72fc00e70 __std_fs_code_page 47 API calls 80384->80385 80386 7ff72fbc23bc 80385->80386 80387 7ff72fbfab78 80386->80387 80388 7ff72fc009fc __std_fs_code_page 47 API calls 80387->80388 80389 7ff72fbfab81 80388->80389 80390 7ff72fc00e70 __std_fs_code_page 47 API calls 80389->80390 80391 7ff72fbc23c4 80390->80391 80391->80381 80392 7ff72fbfaae8 47 API calls __std_fs_code_page 80391->80392 80392->80381 80394 7ff72fbc2085 80393->80394 80395 7ff72f9d4b23 80393->80395 80400 7ff72fbfaa9c 80394->80400 80397 7ff72f9d3a50 80395->80397 80436 7ff72f9e2360 80397->80436 80405 7ff72fc03cf4 80400->80405 80426 7ff72fc032c8 5 API calls __crtLCMapStringW 80405->80426 80407 7ff72fc03d14 80427 7ff72fc032c8 5 API calls __crtLCMapStringW 80407->80427 80409 7ff72fc03d33 80428 7ff72fc032c8 5 API calls __crtLCMapStringW 80409->80428 80411 7ff72fc03d52 80429 7ff72fc032c8 5 API calls __crtLCMapStringW 80411->80429 80413 7ff72fc03d71 80430 7ff72fc032c8 5 API calls __crtLCMapStringW 80413->80430 80415 7ff72fc03d90 80431 7ff72fc032c8 5 API calls __crtLCMapStringW 80415->80431 80417 7ff72fc03daf 80432 7ff72fc032c8 5 API calls __crtLCMapStringW 80417->80432 80419 7ff72fc03dce 80433 7ff72fc032c8 5 API calls __crtLCMapStringW 80419->80433 80421 7ff72fc03ded 80434 7ff72fc032c8 5 API calls __crtLCMapStringW 80421->80434 80423 7ff72fc03e0c 80435 7ff72fc032c8 5 API calls __crtLCMapStringW 80423->80435 80425 7ff72fc03e2b 80426->80407 80427->80409 80428->80411 80429->80413 80430->80415 80431->80417 80432->80419 80433->80421 80434->80423 80435->80425 80437 7ff72f9e2374 80436->80437 80438 7ff72f9d3a63 80436->80438 80440 7ff72fbe9ad0 13 API calls 2 library calls 80437->80440 80438->80356 80440->80438 80441 7ff72fa1b0c0 80442 7ff72fa1b0d8 80441->80442 80445 7ff72fa1b0df Concurrency::details::WorkQueue::IsStructuredEmpty 80441->80445 80443 7ff72fa1b1d7 WaitForSingleObject 80443->80442 80443->80445 80445->80443 80446 7ff72fa17740 ReleaseSRWLockExclusive 80445->80446 80448 7ff72fa17690 57 API calls 80445->80448 80449 7ff72fa1ab80 80445->80449 80462 7ff72fa1be70 80445->80462 80446->80445 80448->80445 80450 7ff72f9d0450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 80449->80450 80451 7ff72fa1abaa 80450->80451 80452 7ff72f9d0450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 80451->80452 80453 7ff72fa1abcf 80452->80453 80454 7ff72f9d0450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 80453->80454 80455 7ff72fa1abf4 80454->80455 80456 7ff72f9d0450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 80455->80456 80457 7ff72fa1ac19 80456->80457 80458 7ff72f9d0450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 80457->80458 80459 7ff72fa1ac3e 80458->80459 80460 7ff72f9d0450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 80459->80460 80461 7ff72fa1ac63 80460->80461 80461->80445 80463 7ff72fa1beb1 allocator std::ios_base::good 80462->80463 80477 7ff72fa1bf50 UnDecorator::getVbTableType 80462->80477 80464 7ff72fa1bf0c WinHttpConnect 80463->80464 80465 7ff72fa1bf57 80464->80465 80466 7ff72f9d05d0 59 API calls 80465->80466 80465->80477 80467 7ff72fa1bf6d GetTickCount64 80466->80467 80468 7ff72fa1c2b6 allocator std::ios_base::good 80467->80468 80469 7ff72f9da250 68 API calls 80468->80469 80470 7ff72fa1c387 allocator 80469->80470 80471 7ff72fa1c392 WinHttpOpenRequest 80470->80471 80472 7ff72fa1c3d1 WinHttpSetTimeouts 80471->80472 80476 7ff72fa1c43c UnDecorator::getVbTableType 80471->80476 80473 7ff72fa1c3f9 80472->80473 80472->80476 80474 7ff72fa1c40d 80473->80474 80475 7ff72fa1c401 WinHttpCloseHandle 80473->80475 80474->80477 80478 7ff72fa1c415 WinHttpCloseHandle 80474->80478 80475->80474 80479 7ff72fa1c485 80476->80479 80480 7ff72fa1c455 WinHttpSendRequest 80476->80480 80477->80445 80478->80477 80481 7ff72fa1c48c WinHttpReceiveResponse 80479->80481 80482 7ff72fa1c49d 80479->80482 80480->80479 80481->80482 80483 7ff72fa1c4b1 80482->80483 80484 7ff72fa1c4a5 WinHttpCloseHandle 80482->80484 80483->80477 80485 7ff72fa1c4b9 WinHttpCloseHandle 80483->80485 80484->80483 80485->80477 80486 7ff72fa1af80 80487 7ff72f9d11a0 _Mpunct 51 API calls 80486->80487 80488 7ff72fa1afaa 80487->80488 80489 7ff72fa198a0 70 API calls 80488->80489 80490 7ff72fa1afbe 80489->80490 80491 7ff72f9d0450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 80490->80491 80492 7ff72fa1afd8 80491->80492 80493 7ff72fa18e90 70 API calls 80492->80493 80494 7ff72fa1afec allocator 80493->80494 80495 7ff72fa1affb WinHttpOpen 80494->80495 80496 7ff72fa1b02d UnDecorator::getVbTableType 80495->80496 80497 7ff72fa1b058 WinHttpSetTimeouts 80496->80497 80498 7ff72fa1b040 UnDecorator::getVbTableType 80496->80498 80497->80498 80499 7ff72fa2ee00 80502 7ff72fa38c10 CoUninitialize 80499->80502 80501 7ff72fa2ee13 80502->80501 80503 7ff72fbcf5e8 80504 7ff72fbcf6b5 80503->80504 80505 7ff72fbcf60d 80503->80505 80505->80504 80506 7ff72fbe2bd0 std::_Facet_Register 4 API calls 80505->80506 80508 7ff72fbcf61e 80506->80508 80507 7ff72fbcf69b 80507->80504 80510 7ff72f9d4b10 std::bad_exception::bad_exception 84 API calls 80507->80510 80508->80507 80509 7ff72f9d2c70 std::bad_exception::bad_exception 86 API calls 80508->80509 80511 7ff72fbcf657 80509->80511 80510->80504 80515 7ff72fbc9cb4 80511->80515 80513 7ff72fbcf696 80530 7ff72fbe23bc 48 API calls _Getctype 80513->80530 80516 7ff72fbc2390 std::bad_exception::bad_exception 47 API calls 80515->80516 80517 7ff72fbc9cdc 80516->80517 80531 7ff72fbfb3f8 80517->80531 80520 7ff72fbc9d22 80546 7ff72fbfb544 48 API calls 5 library calls 80520->80546 80522 7ff72fbc9d1a 80545 7ff72fbe9ad0 13 API calls 2 library calls 80522->80545 80525 7ff72fbc9d44 80528 7ff72fbc9d63 80525->80528 80547 7ff72fa05a10 13 API calls 2 library calls 80525->80547 80527 7ff72fbc9d5b 80548 7ff72fbe9ad0 13 API calls 2 library calls 80527->80548 80528->80513 80530->80507 80532 7ff72fbfb400 80531->80532 80533 7ff72fbf0764 TranslateName 47 API calls 80532->80533 80534 7ff72fbfb424 80533->80534 80535 7ff72fc00e10 std::_Locinfo::_Locinfo_ctor 12 API calls 80534->80535 80543 7ff72fbfb476 80535->80543 80536 7ff72fbfb4f3 80537 7ff72fc00dd4 __free_lconv_mon 11 API calls 80536->80537 80539 7ff72fbc9d03 80537->80539 80538 7ff72fc005f8 47 API calls __std_exception_copy 80538->80543 80539->80520 80544 7ff72fa05a10 13 API calls 2 library calls 80539->80544 80540 7ff72fbfb52d 80541 7ff72fbe8fd4 _invalid_parameter_noinfo_noreturn 17 API calls 80540->80541 80542 7ff72fbfb542 80541->80542 80543->80536 80543->80538 80543->80540 80544->80522 80545->80520 80546->80525 80547->80527 80548->80528 80549 7ff72fa525a0 80557 7ff72f9cd210 80549->80557 80551 7ff72fa525c1 RegCreateKeyW 80552 7ff72fa525dc allocator 80551->80552 80556 7ff72fa5263f UnDecorator::getVbTableType 80551->80556 80553 7ff72fa525e6 RegSetValueExW 80552->80553 80554 7ff72fa52624 RegCloseKey 80553->80554 80555 7ff72fa52652 RegCloseKey 80553->80555 80554->80556 80555->80556 80557->80551

                                                                                                                                                                                                                                            Executed Functions

                                                                                                                                                                                                                                            Function 00007FF72FA495B0 Relevance: 88.4, APIs: 39, Strings: 11, Instructions: 865timeCOMMON
                                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                                            control_flow_graph 0 7ff72fa495b0-7ff72fa49672 call 7ff72f9d1200 * 2 call 7ff72fa0ca20 call 7ff72f9d0510 call 7ff72f9cd210 call 7ff72fa343b0 call 7ff72fa34e20 call 7ff72fa2f650 17 7ff72fa49678-7ff72fa496dc call 7ff72fa38170 call 7ff72fa55ad0 call 7ff72f9e5cb0 0->17 18 7ff72fa49741 0->18 17->18 42 7ff72fa496de-7ff72fa49732 call 7ff72fa38170 call 7ff72fa55ad0 call 7ff72f9e5cb0 17->42 19 7ff72fa4974c-7ff72fa49761 18->19 21 7ff72fa49763-7ff72fa49775 call 7ff72f9d3c10 19->21 22 7ff72fa49776-7ff72fa4977f 19->22 21->22 26 7ff72fa49794-7ff72fa4979b 22->26 27 7ff72fa49781-7ff72fa49793 call 7ff72f9d3c10 22->27 28 7ff72fa497a1-7ff72fa4982d call 7ff72fa55a70 call 7ff72f9d5040 call 7ff72f9d3c10 call 7ff72fa55a70 call 7ff72f9d5040 call 7ff72f9d3c10 26->28 29 7ff72fa49832-7ff72fa49974 call 7ff72f9d05d0 call 7ff72f9d11a0 call 7ff72fa198a0 call 7ff72f9d0450 call 7ff72fa18e90 call 7ff72f9cd210 call 7ff72f9da250 call 7ff72f9d3680 call 7ff72fa1d390 call 7ff72fbe3da0 call 7ff72f9d3680 * 2 26->29 27->26 69 7ff72fa49975-7ff72fa49a40 call 7ff72f9d11a0 call 7ff72fa198a0 call 7ff72f9d0450 call 7ff72fa18e90 call 7ff72f9cd210 WinHttpOpen call 7ff72f9d3680 28->69 29->69 42->18 61 7ff72fa49734-7ff72fa4973f 42->61 61->19 93 7ff72fa49b4d-7ff72fa49b73 WinHttpSetTimeouts 69->93 94 7ff72fa49a46-7ff72fa49b4c call 7ff72f9d11a0 call 7ff72fa198a0 GetLastError call 7ff72f9d0450 call 7ff72fa18e90 call 7ff72fa1d3e0 call 7ff72fbe3da0 call 7ff72f9d3680 * 2 69->94 96 7ff72fa49c8c-7ff72fa49cba call 7ff72f9e3200 WinHttpConnect 93->96 97 7ff72fa49b79-7ff72fa49c8b WinHttpCloseHandle call 7ff72f9d11a0 call 7ff72fa198a0 GetLastError call 7ff72f9d0450 call 7ff72fa18e90 call 7ff72fa1d3e0 call 7ff72fbe3da0 call 7ff72f9d3680 * 2 93->97 94->93 106 7ff72fa49dd3-7ff72fa49eda call 7ff72f9d11a0 call 7ff72fa198a0 call 7ff72f9e3200 call 7ff72f9d0450 call 7ff72fa18e90 call 7ff72f9cd210 WinHttpOpenRequest call 7ff72f9d3680 96->106 107 7ff72fa49cc0-7ff72fa49dd2 WinHttpCloseHandle call 7ff72f9d11a0 call 7ff72fa198a0 GetLastError call 7ff72f9d0450 call 7ff72fa18e90 call 7ff72fa1d3e0 call 7ff72fbe3da0 call 7ff72f9d3680 * 2 96->107 97->96 162 7ff72fa49ffe-7ff72fa4a038 WinHttpSendRequest 106->162 163 7ff72fa49ee0-7ff72fa49ffd WinHttpCloseHandle * 2 call 7ff72f9d11a0 call 7ff72fa198a0 GetLastError call 7ff72f9d0450 call 7ff72fa18e90 call 7ff72fa1d3e0 call 7ff72fbe3da0 call 7ff72f9d3680 * 2 106->163 107->106 166 7ff72fa4a03e-7ff72fa4a04d WinHttpReceiveResponse 162->166 167 7ff72fa4a1a8-7ff72fa4a2d0 WinHttpCloseHandle * 3 call 7ff72f9d11a0 call 7ff72fa198a0 GetLastError call 7ff72f9d0450 call 7ff72fa18e90 call 7ff72fa1d3e0 call 7ff72fbe3da0 call 7ff72f9d3680 * 2 162->167 163->162 166->167 170 7ff72fa4a053-7ff72fa4a09c WinHttpQueryHeaders 166->170 175 7ff72fa4a2d1-7ff72fa4a304 call 7ff72f9d1680 call 7ff72fa342e0 167->175 173 7ff72fa4a1a3 170->173 174 7ff72fa4a0a2-7ff72fa4a0ab GetLastError 170->174 173->175 174->173 178 7ff72fa4a0b1-7ff72fa4a0b6 174->178 197 7ff72fa4a30a-7ff72fa4a336 call 7ff72f9cd210 call 7ff72fa341a0 175->197 198 7ff72fa4a493-7ff72fa4a4bb call 7ff72f9d1390 call 7ff72fa383c0 175->198 178->173 182 7ff72fa4a0bc-7ff72fa4a14d call 7ff72f9d1200 call 7ff72f9ec710 call 7ff72f9ec1b0 call 7ff72f9e3200 WinHttpQueryHeaders call 7ff72f9ec710 178->182 236 7ff72fa4a195-7ff72fa4a1a2 call 7ff72f9d3c10 182->236 237 7ff72fa4a14f-7ff72fa4a194 call 7ff72fa345f0 call 7ff72fa37cb0 call 7ff72fa160e0 182->237 219 7ff72fa4a33b-7ff72fa4a389 call 7ff72fa378d0 call 7ff72fa39330 call 7ff72fa4e640 197->219 224 7ff72fa4a4bd-7ff72fa4a4e0 call 7ff72fa1e7c0 198->224 225 7ff72fa4a4e1-7ff72fa4a4ed 198->225 219->198 260 7ff72fa4a38f-7ff72fa4a492 WinHttpCloseHandle * 3 call 7ff72f9d11a0 call 7ff72fa198a0 call 7ff72f9d0450 call 7ff72fa18e90 call 7ff72fa1d390 call 7ff72fbe3da0 call 7ff72f9d3680 * 2 219->260 224->225 226 7ff72fa4a4f2-7ff72fa4a504 call 7ff72fa38ed0 225->226 244 7ff72fa4a84b-7ff72fa4a855 226->244 245 7ff72fa4a50a-7ff72fa4a524 WinHttpQueryDataAvailable 226->245 236->173 237->236 249 7ff72fa4a857-7ff72fa4a85f call 7ff72fa46510 244->249 250 7ff72fa4a865-7ff72fa4a952 WinHttpCloseHandle * 3 call 7ff72f9d3ce0 call 7ff72fa39330 call 7ff72f9f9470 call 7ff72f9d3680 * 2 call 7ff72fa371a0 call 7ff72fa36f70 call 7ff72f9d3680 call 7ff72f9d3c10 * 3 call 7ff72f9d3ce0 * 2 244->250 251 7ff72fa4a52a-7ff72fa4a630 call 7ff72f9d11a0 call 7ff72fa198a0 GetLastError call 7ff72f9d0450 call 7ff72fa18e90 call 7ff72fa1d3e0 call 7ff72fbe3da0 call 7ff72f9d3680 * 2 245->251 252 7ff72fa4a631-7ff72fa4a636 245->252 262 7ff72fa4a864 249->262 251->252 258 7ff72fa4a638-7ff72fa4a63d 252->258 259 7ff72fa4a642-7ff72fa4a6c4 call 7ff72f9fbc10 call 7ff72fa52b60 call 7ff72fa52c10 call 7ff72fa55190 call 7ff72f9e2900 WinHttpReadData 252->259 258->244 307 7ff72fa4a6ca-7ff72fa4a6d4 259->307 308 7ff72fa4a83f-7ff72fa4a844 259->308 260->198 262->250 313 7ff72fa4a6da-7ff72fa4a713 call 7ff72f9e2900 call 7ff72fa574d0 307->313 314 7ff72fa4a770-7ff72fa4a829 call 7ff72f9d1200 call 7ff72f9ff420 call 7ff72f9fb5c0 call 7ff72fa2a240 call 7ff72f9e3200 call 7ff72fa574d0 307->314 308->244 333 7ff72fa4a718-7ff72fa4a72b call 7ff72fa383c0 313->333 354 7ff72fa4a82e-7ff72fa4a846 call 7ff72f9d3c10 314->354 333->314 342 7ff72fa4a72d-7ff72fa4a736 333->342 342->314 345 7ff72fa4a738-7ff72fa4a76f call 7ff72fa38e40 342->345 345->314 354->226
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Http$CloseHandle$Concurrency::details::EmptyErrorLastQueue::StructuredWork$shared_ptr$Query$Concurrency::details::_CriticalDataHeadersLock::_OpenReentrantRequestScoped_lockScoped_lock::~_type_info::_name_internal_method$AvailableChar_traitsConnectDecorator::getExceptionFileHeaderListRaiseReadReceiveResponseSafeSendTableTimeoutsType
                                                                                                                                                                                                                                            • String ID: GET$URL format is not valid : %ws$WinHTTP 1.0$^(https?://(?:www.)?([^/]+))(/.*)?$$file creation failure$handle connection failure$handle initialization failure$handle request creation failure$handle request or response failure$query data not available$timeout init failure
                                                                                                                                                                                                                                            • API String ID: 5397687-202491335
                                                                                                                                                                                                                                            • Opcode ID: eca5bead351e5e53399ea4e1a60e16f94a0797ac6dbed0f2f85b2bc50417913f
                                                                                                                                                                                                                                            • Instruction ID: e95c0c52737ea01fe810fb51c564c00b547a1c857967b730e01864e9551b5490
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: eca5bead351e5e53399ea4e1a60e16f94a0797ac6dbed0f2f85b2bc50417913f
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 99A2F33260DAC295EA70AB14E8947EBB364FBC5780F805136D6CD83AA9EF2CD545CF50
                                                                                                                                                                                                                                            Function 00007FF72FA2BFE0 Relevance: 31.7, APIs: 12, Strings: 6, Instructions: 210libraryloaderCOMMON
                                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                                            control_flow_graph 3244 7ff72fa2bfe0-7ff72fa2c003 3245 7ff72fa2c052-7ff72fa2c09a call 7ff72fa2ef00 3244->3245 3246 7ff72fa2c005-7ff72fa2c04d call 7ff72f9d2a70 3244->3246 3251 7ff72fa2c0a4-7ff72fa2c0d1 call 7ff72f9d2a70 call 7ff72f9f0720 * 2 3245->3251 3254 7ff72fa2c41c-7ff72fa2c423 3246->3254 3260 7ff72fa2c0d7-7ff72fa2c0fd LoadLibraryW GetProcAddress 3251->3260 3261 7ff72fa2c17c-7ff72fa2c188 call 7ff72f9f0720 3251->3261 3263 7ff72fa2c11a-7ff72fa2c178 call 7ff72f9d2a70 3260->3263 3264 7ff72fa2c0ff-7ff72fa2c115 3260->3264 3266 7ff72fa2c18a-7ff72fa2c1a1 call 7ff72f9d2a70 3261->3266 3267 7ff72fa2c1a6-7ff72fa2c209 call 7ff72fa34790 call 7ff72fa520d0 call 7ff72fc1387c call 7ff72f9cbc20 * 2 call 7ff72fa1e190 3261->3267 3263->3261 3264->3254 3266->3254 3286 7ff72fa2c212-7ff72fa2c232 call 7ff72fa52fb0 3267->3286 3289 7ff72fa2c238-7ff72fa2c2a8 call 7ff72f9ec710 call 7ff72f9d7170 call 7ff72f9e3200 LoadLibraryW call 7ff72f9d02f0 call 7ff72f9ea8b0 call 7ff72f9ec710 call 7ff72fa38400 3286->3289 3290 7ff72fa2c3de-7ff72fa2c414 call 7ff72f9cd210 call 7ff72fc13882 call 7ff72f9d3c10 call 7ff72fa37010 3286->3290 3313 7ff72fa2c2ba-7ff72fa2c2de call 7ff72f9cd210 GetProcAddress 3289->3313 3314 7ff72fa2c2aa-7ff72fa2c2b5 call 7ff72fa37090 3289->3314 3290->3254 3319 7ff72fa2c2f0-7ff72fa2c348 call 7ff72fa34790 call 7ff72fa520d0 3313->3319 3320 7ff72fa2c2e0-7ff72fa2c2eb call 7ff72fa37090 3313->3320 3314->3286 3328 7ff72fa2c34a-7ff72fa2c35f call 7ff72fa37010 call 7ff72fa37090 3319->3328 3329 7ff72fa2c364-7ff72fa2c3c2 call 7ff72f9ebcd0 call 7ff72fa47f50 call 7ff72f9d2a70 call 7ff72fa37010 call 7ff72fa37090 call 7ff72f9d3c10 call 7ff72fa37010 3319->3329 3320->3286 3328->3286 3329->3254
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: atomic$AddressLibraryLoadProc
                                                                                                                                                                                                                                            • String ID: .dll$CoIncrementMTAUsage$DllGetActivationFactory$RoGetActivationFactory$combase.dll$combase.dll
                                                                                                                                                                                                                                            • API String ID: 1653574484-4170001172
                                                                                                                                                                                                                                            • Opcode ID: 8fab117c1cdc8e3682f0ec68a2ac1de93d45519c69ca58d2309001f4c9a9c856
                                                                                                                                                                                                                                            • Instruction ID: 9eb0b457d68aab7641e6418a1c0875b13feffe09705180d18a78240b6204056d
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 8fab117c1cdc8e3682f0ec68a2ac1de93d45519c69ca58d2309001f4c9a9c856
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: D0B1C82274CAC681EA60FB15EC517EAE360FB95790F904132E68D83AAADF3CD545CF50
                                                                                                                                                                                                                                            Function 00007FF72FA71860 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 59memoryCOMMON
                                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: GlobalResource$LockName$AllocCreateErrorFindLastLoadNodeNode::SizeofStreamUnlock
                                                                                                                                                                                                                                            • String ID: &$PNG
                                                                                                                                                                                                                                            • API String ID: 404809873-3047161795
                                                                                                                                                                                                                                            • Opcode ID: a2c06dc25bda38559360ae671d947d6f58e99bb9c09f315c507cbfd297364e45
                                                                                                                                                                                                                                            • Instruction ID: d58a2ab03d3a96a9a19b1f5cd6e83d793789059f8a59665f84a3240692e4fb1d
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: a2c06dc25bda38559360ae671d947d6f58e99bb9c09f315c507cbfd297364e45
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 5131EA76618B8586D760AB25F8543AAB7B0FB88794F504035EA8E43B68DF3CD184CF10
                                                                                                                                                                                                                                            Function 00007FF72F9D8790 Relevance: 18.0, APIs: 2, Strings: 8, Instructions: 500COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Concurrency::details::EmptyQueue::StructuredWorkshared_ptr$Char_traitsConcurrency::details::_CriticalDecorator::getHandleLock::_ReentrantScoped_lockScoped_lock::~_TableTypetype_info::_name_internal_method
                                                                                                                                                                                                                                            • String ID: .\nwjs\NW_store.exe$.\ui\.$UI StartedMain process ID:%d$creation_error=%ws$directory_switching_error$product$ui_creation_failed$ui_termination_error
                                                                                                                                                                                                                                            • API String ID: 1646997740-2964731665
                                                                                                                                                                                                                                            • Opcode ID: 98c4c0e90b602cfca8a8e3e52368d83a3f1c87065acc34097fa71be29023c5fb
                                                                                                                                                                                                                                            • Instruction ID: d98b82996ed69148e858338b87a1a834c1d2eadf350d9e7e9478f9b160538925
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 98c4c0e90b602cfca8a8e3e52368d83a3f1c87065acc34097fa71be29023c5fb
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: D742D53260DAC191EA71BB14E8952EBB364FBC9740F901536D6CC82BAEEE2CD545CF50
                                                                                                                                                                                                                                            Function 00007FF72FC11274 Relevance: 13.8, APIs: 9, Instructions: 276fileCOMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 1617910340-0
                                                                                                                                                                                                                                            • Opcode ID: e343539a376f2db1ff088acd6fe61eef78b7cbf5639aa4d1d11734894c44e91c
                                                                                                                                                                                                                                            • Instruction ID: a21191d9c8824c37e30580d38849a3073b657e2ef12a63b9697c18a0dfb1f79d
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: e343539a376f2db1ff088acd6fe61eef78b7cbf5639aa4d1d11734894c44e91c
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 6BC1E232B28A8286EB10DF69D8906ED7765F748BA8F801235DE1E97795CF3CD0A1C710
                                                                                                                                                                                                                                            Function 00007FF72FA55130 Relevance: 3.0, APIs: 2, Instructions: 14keyboardCOMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: keybd_event
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 2665452162-0
                                                                                                                                                                                                                                            • Opcode ID: a042bddbd6d60c66f133c626703260ee003b2161beff19cb918841546142377a
                                                                                                                                                                                                                                            • Instruction ID: 1e4e7aa15a0109382a85cb9062c4c5b397cc8a5976a47341a4b74d99aeeed3dc
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: a042bddbd6d60c66f133c626703260ee003b2161beff19cb918841546142377a
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 99D0C970B210A342E7A03B757C6AFD50FA0EB59BC9FA2B420C90C1BB40CD1A128D0B60
                                                                                                                                                                                                                                            Function 00007FF72FA13D10 Relevance: 55.6, APIs: 9, Strings: 22, Instructions: 1375filesynchronizationCOMMON
                                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                                            control_flow_graph 360 7ff72fa13d10-7ff72fa147f0 call 7ff72fbe2f90 call 7ff72f9d0350 call 7ff72fa0fab0 call 7ff72f9d2bd0 CoInitializeEx call 7ff72f9d11a0 call 7ff72fa198a0 call 7ff72f9d11a0 call 7ff72fa198a0 call 7ff72f9d05d0 call 7ff72f9cd210 call 7ff72f9d0450 call 7ff72fa18e90 call 7ff72f9cd210 call 7ff72f9da250 call 7ff72f9d3680 call 7ff72f9d11a0 call 7ff72fa198a0 call 7ff72f9d11a0 call 7ff72fa198a0 call 7ff72f9d11a0 call 7ff72fa198a0 call 7ff72f9d05d0 call 7ff72fa16ea0 call 7ff72f9cd210 call 7ff72f9d0450 call 7ff72fa18e90 call 7ff72f9cd210 call 7ff72f9da250 call 7ff72f9d3680 call 7ff72f9d0510 * 2 call 7ff72f9d0450 call 7ff72fa18e90 call 7ff72f9d0450 call 7ff72fa18e90 call 7ff72fa5ca30 call 7ff72f9d3680 * 4 call 7ff72f9d05d0 call 7ff72f9cd210 call 7ff72fa16ea0 call 7ff72f9d0450 call 7ff72fa18e90 call 7ff72f9cd210 call 7ff72f9da250 call 7ff72f9d3680 call 7ff72f9d0450 call 7ff72fa6db90 call 7ff72f9d1390 * 2 call 7ff72fa12880 call 7ff72fa495b0 call 7ff72fa160e0 call 7ff72f9d11a0 call 7ff72fa198a0 call 7ff72f9d11a0 call 7ff72fa198a0 call 7ff72f9cd210 call 7ff72f9d0450 call 7ff72fa18e90 call 7ff72f9cd210 call 7ff72f9da250 call 7ff72f9d3680 call 7ff72f9d0510 * 2 call 7ff72f9d0450 call 7ff72fa18e90 call 7ff72f9d0450 call 7ff72fa18e90 call 7ff72fa5ca30 call 7ff72f9d3680 * 4 513 7ff72fa149f1-7ff72fa149f8 360->513 514 7ff72fa147f6-7ff72fa149f0 call 7ff72f9d11a0 call 7ff72fa198a0 call 7ff72f9d11a0 call 7ff72fa198a0 call 7ff72f9d0450 call 7ff72fa18e90 call 7ff72fa6db90 call 7ff72f9d0450 call 7ff72fa18e90 call 7ff72fa6db90 call 7ff72f9d3680 * 2 360->514 515 7ff72fa149fe-7ff72fa14ad2 call 7ff72fc14170 * 2 call 7ff72f9cd210 * 2 ShellExecuteExW 513->515 516 7ff72fa15880-7ff72fa159af call 7ff72f9d3680 * 6 call 7ff72f9d05d0 call 7ff72f9d11a0 call 7ff72fa198a0 call 7ff72f9d11a0 call 7ff72fa198a0 call 7ff72f9d11a0 call 7ff72fa198a0 513->516 514->513 543 7ff72fa14ad8-7ff72fa14bca call 7ff72f9d11a0 call 7ff72fa198a0 call 7ff72f9d0450 call 7ff72fa18e90 call 7ff72fa132d0 call 7ff72fbe3da0 call 7ff72f9d3680 * 2 515->543 544 7ff72fa14bcf-7ff72fa154d0 call 7ff72f9d11a0 call 7ff72fa198a0 call 7ff72f9d05d0 call 7ff72f9d11a0 call 7ff72fa198a0 call 7ff72f9cd210 call 7ff72f9d0450 call 7ff72fa18e90 call 7ff72f9cd210 call 7ff72f9da250 call 7ff72f9d3680 call 7ff72f9d0510 * 2 call 7ff72f9d0450 call 7ff72fa18e90 call 7ff72f9d0450 call 7ff72fa18e90 call 7ff72fa5ca30 call 7ff72f9d3680 * 4 call 7ff72f9d05d0 call 7ff72f9cd210 call 7ff72fa16ea0 call 7ff72f9d0450 call 7ff72fa18e90 call 7ff72f9cd210 call 7ff72f9da250 call 7ff72f9d3680 call 7ff72f9d0450 call 7ff72fa6db90 WaitForSingleObject GetExitCodeProcess call 7ff72f9d11a0 call 7ff72fa198a0 call 7ff72f9d11a0 call 7ff72fa198a0 call 7ff72f9cd210 call 7ff72f9d0450 call 7ff72fa18e90 call 7ff72f9cd210 call 7ff72f9da250 call 7ff72f9d3680 call 7ff72f9d0510 * 2 call 7ff72f9d0450 call 7ff72fa18e90 call 7ff72f9d0450 call 7ff72fa18e90 call 7ff72fa5ca30 call 7ff72f9d3680 * 4 call 7ff72f9d05d0 call 7ff72f9cd210 call 7ff72fa16ea0 call 7ff72f9d0450 call 7ff72fa18e90 call 7ff72f9cd210 call 7ff72f9da250 call 7ff72f9d3680 call 7ff72f9d0450 call 7ff72fa6db90 CloseHandle call 7ff72f9cd210 DeleteFileW 515->544 615 7ff72fa15a3a-7ff72fa15aac call 7ff72f9d0450 call 7ff72fa18e90 call 7ff72f9cd210 516->615 616 7ff72fa159b5-7ff72fa159bc 516->616 543->516 827 7ff72fa157e6-7ff72fa1580a call 7ff72fa45f00 544->827 828 7ff72fa154d6-7ff72fa157e5 call 7ff72f9d11a0 call 7ff72fa198a0 call 7ff72f9d11a0 call 7ff72fa198a0 call 7ff72f9d05d0 call 7ff72f9cd210 GetLastError call 7ff72f9d0450 call 7ff72fa18e90 call 7ff72f9cd210 call 7ff72f9da250 call 7ff72f9d3680 call 7ff72f9d0510 * 2 call 7ff72f9d0450 call 7ff72fa18e90 call 7ff72f9d0450 call 7ff72fa18e90 call 7ff72fa5ca30 call 7ff72f9d3680 * 7 544->828 637 7ff72fa15ab4-7ff72fa15ad3 call 7ff72f9d0510 615->637 616->615 617 7ff72fa159be-7ff72fa15a38 call 7ff72f9d0450 call 7ff72fa18e90 call 7ff72f9cd210 616->617 617->637 642 7ff72fa15ae8-7ff72fa15af1 637->642 643 7ff72fa15ad5-7ff72fa15ae7 call 7ff72f9d3680 637->643 646 7ff72fa15af3-7ff72fa15b05 call 7ff72f9d3680 642->646 647 7ff72fa15b06-7ff72fa15b1b call 7ff72f9d05d0 642->647 643->642 646->647 656 7ff72fa15b1d-7ff72fa15b24 647->656 657 7ff72fa15b30 647->657 656->657 659 7ff72fa15b26-7ff72fa15b2e 656->659 661 7ff72fa15b38-7ff72fa15ed2 call 7ff72f9cd210 call 7ff72fa16ea0 call 7ff72f9d0450 call 7ff72fa18e90 call 7ff72f9cd210 call 7ff72f9da250 call 7ff72f9d3680 call 7ff72f9d0450 call 7ff72fa6db90 call 7ff72f9cd210 call 7ff72fa16ea0 call 7ff72f9d0450 call 7ff72fa18e90 call 7ff72f9cd210 call 7ff72f9da250 call 7ff72f9d3680 call 7ff72f9d0450 call 7ff72fa6db90 call 7ff72f9d3680 * 10 call 7ff72f9d46c0 657->661 659->661 777 7ff72fa15ed7-7ff72fa15f42 call 7ff72f9d3680 * 5 call 7ff72f9d3ce0 * 2 661->777 833 7ff72fa1580c-7ff72fa15811 827->833 834 7ff72fa15813 827->834 828->827 836 7ff72fa15818-7ff72fa1587f call 7ff72f9d3680 * 7 833->836 834->836 836->516
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FF72FA13D65
                                                                                                                                                                                                                                            • CoInitializeEx.OLE32 ref: 00007FF72FA13D9F
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72F9D11A0: _WChar_traits.LIBCPMTD ref: 00007FF72F9D11CD
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA198A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF72FA19930
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA198A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72FA1995D
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA198A0: shared_ptr.LIBCMTD ref: 00007FF72FA19993
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA198A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72FA19A2E
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA18E90: shared_ptr.LIBCMTD ref: 00007FF72FA18F05
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA18E90: shared_ptr.LIBCMTD ref: 00007FF72FA18F8E
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA18E90: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72FA19190
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72F9D0510: UnDecorator::getVbTableType.LIBCMTD ref: 00007FF72F9D0551
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA5CA30: Concurrency::cancellation_token::_FromImpl.LIBCPMTD ref: 00007FF72FA5CAA0
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA5CA30: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72FA5CAB9
                                                                                                                                                                                                                                            • ShellExecuteExW.SHELL32 ref: 00007FF72FA14ACA
                                                                                                                                                                                                                                            • Concurrency::scheduler_worker_creation_error::scheduler_worker_creation_error.LIBCMTD ref: 00007FF72FA14B93
                                                                                                                                                                                                                                            • WaitForSingleObject.KERNEL32 ref: 00007FF72FA15030
                                                                                                                                                                                                                                            • GetExitCodeProcess.KERNEL32 ref: 00007FF72FA1504B
                                                                                                                                                                                                                                            • CloseHandle.KERNEL32 ref: 00007FF72FA154B1
                                                                                                                                                                                                                                            • DeleteFileW.KERNEL32 ref: 00007FF72FA154C8
                                                                                                                                                                                                                                            • GetLastError.KERNEL32 ref: 00007FF72FA1558B
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Concurrency::details::EmptyQueue::StructuredWork$shared_ptr$Char_traitsCloseCodeConcurrency::cancellation_token::_Concurrency::scheduler_worker_creation_error::scheduler_worker_creation_errorDecorator::getDeleteErrorExecuteExitFac_nodeFac_node::_FileFromHandleImplInitializeLastObjectProcessShellSingleTableTypeWaitstd::_type_info::_name_internal_method
                                                                                                                                                                                                                                            • String ID: 4D802742-3099-9C0E-C19B-2A23EA1FC420$@$Execution failure$delete_error$dl_start$dl_successful$eC=%d&oid=%d&entry_app=%ws$exec_end$exec_start$h$https://pcapp.store/dl_cta_open.php?guid=%ws&oid=%lu&entryApp=%ws$installed$none$oid=%d&entry_app=%ws$oid=%d&entry_app=%ws&exitCode=%d$oid=%d&entry_app=%ws&source=%ws$p$product${"app" : {"%ws" : {"dl_app_result" : {"name":"%ws","status" : %d}}}}${"app": {"notifications": {"offerIsOpen": false}}}${"app":{"%ws":{"app_status":{"name":"%ws","status":"%ws"}}}}${"app":{"offer": {"offerInfo":{"oid":0,"otype":""}},"hide_window":"offer"}}
                                                                                                                                                                                                                                            • API String ID: 2903385420-3880494428
                                                                                                                                                                                                                                            • Opcode ID: 4c9313af296b2864cceaf5644a678ad3d1d2d66f0c60a2893186291999bad785
                                                                                                                                                                                                                                            • Instruction ID: d657b87a2800be084d5f0dbe645bff27d0a7dafa7431f8edf33858e35d9ec8ae
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 4c9313af296b2864cceaf5644a678ad3d1d2d66f0c60a2893186291999bad785
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 6C03C232609EC195EA70AB15E8906EBB3A4FBC9744F801126D6CD83BA9EF3CD554CF50
                                                                                                                                                                                                                                            Function 00007FF72F9E6570 Relevance: 54.4, APIs: 15, Strings: 15, Instructions: 1912COMMON
                                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                                            control_flow_graph 898 7ff72f9e6570-7ff72f9e6db1 call 7ff72fbe2f90 call 7ff72f9d11a0 call 7ff72fa198a0 call 7ff72f9cd210 call 7ff72f9d11a0 call 7ff72f9d3680 call 7ff72f9d11a0 call 7ff72fa198a0 call 7ff72f9cd210 call 7ff72f9d11a0 call 7ff72f9d3680 call 7ff72f9d11a0 call 7ff72fa198a0 call 7ff72f9cd210 call 7ff72f9d11a0 call 7ff72f9d3680 call 7ff72f9d11a0 call 7ff72fa198a0 call 7ff72f9cd210 call 7ff72f9d11a0 call 7ff72f9d3680 call 7ff72f9d11a0 call 7ff72fa198a0 call 7ff72f9cd210 call 7ff72f9d11a0 call 7ff72f9d3680 call 7ff72f9d11a0 call 7ff72fa198a0 call 7ff72f9cd210 call 7ff72f9d11a0 call 7ff72f9d3680 call 7ff72f9d11a0 call 7ff72fa198a0 call 7ff72f9cd210 call 7ff72f9d11a0 call 7ff72f9d3680 call 7ff72f9d11a0 call 7ff72fa198a0 call 7ff72f9cd210 call 7ff72f9d11a0 call 7ff72f9d3680 call 7ff72f9d11a0 call 7ff72fa198a0 call 7ff72f9cd210 call 7ff72f9d11a0 call 7ff72f9d3680 call 7ff72f9d11a0 call 7ff72fa198a0 call 7ff72f9cd210 call 7ff72f9d11a0 call 7ff72f9d3680 call 7ff72f9d11a0 call 7ff72fa198a0 call 7ff72f9cd210 call 7ff72f9d11a0 call 7ff72f9d3680 call 7ff72f9d11a0 call 7ff72fa198a0 call 7ff72f9cd210 call 7ff72f9d11a0 call 7ff72f9d3680 call 7ff72f9d11a0 call 7ff72fa198a0 call 7ff72f9cd210 call 7ff72f9d11a0 call 7ff72f9d3680 call 7ff72f9d11a0 call 7ff72fa198a0 call 7ff72f9d11a0 call 7ff72fa198a0 call 7ff72f9d0450 call 7ff72fa18e90 call 7ff72f9d10b0 call 7ff72fa19220 call 7ff72fa52310 1049 7ff72f9e6f10-7ff72f9e6fc9 call 7ff72f9d10b0 call 7ff72fa19220 call 7ff72f9cd210 call 7ff72f9d11a0 call 7ff72f9d56a0 call 7ff72f9d5160 call 7ff72f9d3c10 call 7ff72f9d3680 898->1049 1050 7ff72f9e6db7-7ff72f9e6e38 call 7ff72f9d0450 call 7ff72fa18e90 call 7ff72fa3a800 call 7ff72f9d3680 898->1050 1085 7ff72f9e6fd0-7ff72f9e70d9 call 7ff72f9d0450 call 7ff72fa18e90 call 7ff72f9d10b0 call 7ff72fa19220 call 7ff72fa52310 1049->1085 1068 7ff72f9e6e48-7ff72f9e6e4f 1050->1068 1069 7ff72f9e6e3a-7ff72f9e6e46 1050->1069 1071 7ff72f9e6e54-7ff72f9e6f0b call 7ff72f9d10b0 call 7ff72fa19220 call 7ff72f9cd210 call 7ff72f9d11a0 call 7ff72f9d56a0 call 7ff72f9d5160 call 7ff72f9d3c10 call 7ff72f9d3680 1068->1071 1069->1071 1071->1085 1105 7ff72f9e7203-7ff72f9e72bc call 7ff72f9d10b0 call 7ff72fa19220 call 7ff72f9cd210 call 7ff72f9d11a0 call 7ff72f9d56a0 call 7ff72f9d5160 call 7ff72f9d3c10 call 7ff72f9d3680 1085->1105 1106 7ff72f9e70df-7ff72f9e71e5 call 7ff72f9f04f0 call 7ff72f9d10b0 call 7ff72fa19220 call 7ff72f9cd210 call 7ff72f9d11a0 call 7ff72f9d56a0 call 7ff72f9d5040 call 7ff72f9d3c10 call 7ff72f9d3680 call 7ff72f9d3c10 1085->1106 1139 7ff72f9e72c3-7ff72f9e73cc call 7ff72f9d0450 call 7ff72fa18e90 call 7ff72f9d10b0 call 7ff72fa19220 call 7ff72fa52310 1105->1139 1148 7ff72f9e71ee 1106->1148 1149 7ff72f9e71e7-7ff72f9e71ec 1106->1149 1157 7ff72f9e74f6-7ff72f9e75af call 7ff72f9d10b0 call 7ff72fa19220 call 7ff72f9cd210 call 7ff72f9d11a0 call 7ff72f9d56a0 call 7ff72f9d5160 call 7ff72f9d3c10 call 7ff72f9d3680 1139->1157 1158 7ff72f9e73d2-7ff72f9e74d8 call 7ff72f9f04f0 call 7ff72f9d10b0 call 7ff72fa19220 call 7ff72f9cd210 call 7ff72f9d11a0 call 7ff72f9d56a0 call 7ff72f9d5040 call 7ff72f9d3c10 call 7ff72f9d3680 call 7ff72f9d3c10 1139->1158 1151 7ff72f9e71f3-7ff72f9e71fe 1148->1151 1149->1151 1151->1139 1191 7ff72f9e75b6-7ff72f9e76bf call 7ff72f9d0450 call 7ff72fa18e90 call 7ff72f9d10b0 call 7ff72fa19220 call 7ff72fa52310 1157->1191 1199 7ff72f9e74e1 1158->1199 1200 7ff72f9e74da-7ff72f9e74df 1158->1200 1209 7ff72f9e76c5-7ff72f9e77cb call 7ff72f9f04f0 call 7ff72f9d10b0 call 7ff72fa19220 call 7ff72f9cd210 call 7ff72f9d11a0 call 7ff72f9d56a0 call 7ff72f9d5040 call 7ff72f9d3c10 call 7ff72f9d3680 call 7ff72f9d3c10 1191->1209 1210 7ff72f9e77e2-7ff72f9e789b call 7ff72f9d10b0 call 7ff72fa19220 call 7ff72f9cd210 call 7ff72f9d11a0 call 7ff72f9d56a0 call 7ff72f9d5160 call 7ff72f9d3c10 call 7ff72f9d3680 1191->1210 1202 7ff72f9e74e6-7ff72f9e74f1 1199->1202 1200->1202 1202->1191 1251 7ff72f9e77d6 1209->1251 1252 7ff72f9e77cd-7ff72f9e77d4 1209->1252 1244 7ff72f9e78a2-7ff72f9e79ab call 7ff72f9d0450 call 7ff72fa18e90 call 7ff72f9d10b0 call 7ff72fa19220 call 7ff72fa52310 1210->1244 1261 7ff72f9e79b1-7ff72f9e7ab7 call 7ff72f9f04f0 call 7ff72f9d10b0 call 7ff72fa19220 call 7ff72f9cd210 call 7ff72f9d11a0 call 7ff72f9d56a0 call 7ff72f9d5040 call 7ff72f9d3c10 call 7ff72f9d3680 call 7ff72f9d3c10 1244->1261 1262 7ff72f9e7adb-7ff72f9e7b94 call 7ff72f9d10b0 call 7ff72fa19220 call 7ff72f9cd210 call 7ff72f9d11a0 call 7ff72f9d56a0 call 7ff72f9d5160 call 7ff72f9d3c10 call 7ff72f9d3680 1244->1262 1254 7ff72f9e77dd 1251->1254 1252->1254 1254->1244 1304 7ff72f9e7ac3 1261->1304 1305 7ff72f9e7ab9-7ff72f9e7ac1 1261->1305 1296 7ff72f9e7b9b-7ff72f9e7ca4 call 7ff72f9d0450 call 7ff72fa18e90 call 7ff72f9d10b0 call 7ff72fa19220 call 7ff72fa52310 1262->1296 1313 7ff72f9e7dce-7ff72f9e7e87 call 7ff72f9d10b0 call 7ff72fa19220 call 7ff72f9cd210 call 7ff72f9d11a0 call 7ff72f9d56a0 call 7ff72f9d5160 call 7ff72f9d3c10 call 7ff72f9d3680 1296->1313 1314 7ff72f9e7caa-7ff72f9e7db0 call 7ff72f9f04f0 call 7ff72f9d10b0 call 7ff72fa19220 call 7ff72f9cd210 call 7ff72f9d11a0 call 7ff72f9d56a0 call 7ff72f9d5040 call 7ff72f9d3c10 call 7ff72f9d3680 call 7ff72f9d3c10 1296->1314 1307 7ff72f9e7acb-7ff72f9e7ad6 1304->1307 1305->1307 1307->1296 1347 7ff72f9e7e8e-7ff72f9e7f97 call 7ff72f9d0450 call 7ff72fa18e90 call 7ff72f9d10b0 call 7ff72fa19220 call 7ff72fa52310 1313->1347 1356 7ff72f9e7db2-7ff72f9e7db7 1314->1356 1357 7ff72f9e7db9 1314->1357 1365 7ff72f9e80c1-7ff72f9e817a call 7ff72f9d10b0 call 7ff72fa19220 call 7ff72f9cd210 call 7ff72f9d11a0 call 7ff72f9d56a0 call 7ff72f9d5160 call 7ff72f9d3c10 call 7ff72f9d3680 1347->1365 1366 7ff72f9e7f9d-7ff72f9e80a3 call 7ff72f9f04f0 call 7ff72f9d10b0 call 7ff72fa19220 call 7ff72f9cd210 call 7ff72f9d11a0 call 7ff72f9d56a0 call 7ff72f9d5040 call 7ff72f9d3c10 call 7ff72f9d3680 call 7ff72f9d3c10 1347->1366 1359 7ff72f9e7dbe-7ff72f9e7dc9 1356->1359 1357->1359 1359->1347 1399 7ff72f9e8181-7ff72f9e828a call 7ff72f9d0450 call 7ff72fa18e90 call 7ff72f9d10b0 call 7ff72fa19220 call 7ff72fa52310 1365->1399 1407 7ff72f9e80a5-7ff72f9e80aa 1366->1407 1408 7ff72f9e80ac 1366->1408 1417 7ff72f9e83b4-7ff72f9e846d call 7ff72f9d10b0 call 7ff72fa19220 call 7ff72f9cd210 call 7ff72f9d11a0 call 7ff72f9d56a0 call 7ff72f9d5160 call 7ff72f9d3c10 call 7ff72f9d3680 1399->1417 1418 7ff72f9e8290-7ff72f9e8396 call 7ff72f9f04f0 call 7ff72f9d10b0 call 7ff72fa19220 call 7ff72f9cd210 call 7ff72f9d11a0 call 7ff72f9d56a0 call 7ff72f9d5040 call 7ff72f9d3c10 call 7ff72f9d3680 call 7ff72f9d3c10 1399->1418 1410 7ff72f9e80b1-7ff72f9e80bc 1407->1410 1408->1410 1410->1399 1452 7ff72f9e8474-7ff72f9e857d call 7ff72f9d0450 call 7ff72fa18e90 call 7ff72f9d10b0 call 7ff72fa19220 call 7ff72fa52310 1417->1452 1459 7ff72f9e839f 1418->1459 1460 7ff72f9e8398-7ff72f9e839d 1418->1460 1469 7ff72f9e8583-7ff72f9e8689 call 7ff72f9f04f0 call 7ff72f9d10b0 call 7ff72fa19220 call 7ff72f9cd210 call 7ff72f9d11a0 call 7ff72f9d56a0 call 7ff72f9d5040 call 7ff72f9d3c10 call 7ff72f9d3680 call 7ff72f9d3c10 1452->1469 1470 7ff72f9e86ad-7ff72f9e8766 call 7ff72f9d10b0 call 7ff72fa19220 call 7ff72f9cd210 call 7ff72f9d11a0 call 7ff72f9d56a0 call 7ff72f9d5160 call 7ff72f9d3c10 call 7ff72f9d3680 1452->1470 1462 7ff72f9e83a4-7ff72f9e83af 1459->1462 1460->1462 1462->1452 1512 7ff72f9e8695 1469->1512 1513 7ff72f9e868b-7ff72f9e8693 1469->1513 1504 7ff72f9e876d-7ff72f9e8876 call 7ff72f9d0450 call 7ff72fa18e90 call 7ff72f9d10b0 call 7ff72fa19220 call 7ff72fa52310 1470->1504 1521 7ff72f9e89a0-7ff72f9e8a59 call 7ff72f9d10b0 call 7ff72fa19220 call 7ff72f9cd210 call 7ff72f9d11a0 call 7ff72f9d56a0 call 7ff72f9d5160 call 7ff72f9d3c10 call 7ff72f9d3680 1504->1521 1522 7ff72f9e887c-7ff72f9e8982 call 7ff72f9f04f0 call 7ff72f9d10b0 call 7ff72fa19220 call 7ff72f9cd210 call 7ff72f9d11a0 call 7ff72f9d56a0 call 7ff72f9d5040 call 7ff72f9d3c10 call 7ff72f9d3680 call 7ff72f9d3c10 1504->1522 1515 7ff72f9e869d-7ff72f9e86a8 1512->1515 1513->1515 1515->1504 1555 7ff72f9e8a60-7ff72f9e8b69 call 7ff72f9d0450 call 7ff72fa18e90 call 7ff72f9d10b0 call 7ff72fa19220 call 7ff72fa52310 1521->1555 1564 7ff72f9e8984-7ff72f9e8989 1522->1564 1565 7ff72f9e898b 1522->1565 1573 7ff72f9e8c93-7ff72f9e8d4c call 7ff72f9d10b0 call 7ff72fa19220 call 7ff72f9cd210 call 7ff72f9d11a0 call 7ff72f9d56a0 call 7ff72f9d5160 call 7ff72f9d3c10 call 7ff72f9d3680 1555->1573 1574 7ff72f9e8b6f-7ff72f9e8c75 call 7ff72f9f04f0 call 7ff72f9d10b0 call 7ff72fa19220 call 7ff72f9cd210 call 7ff72f9d11a0 call 7ff72f9d56a0 call 7ff72f9d5040 call 7ff72f9d3c10 call 7ff72f9d3680 call 7ff72f9d3c10 1555->1574 1567 7ff72f9e8990-7ff72f9e899b 1564->1567 1565->1567 1567->1555 1607 7ff72f9e8d53-7ff72f9e8e5c call 7ff72f9d0450 call 7ff72fa18e90 call 7ff72f9d10b0 call 7ff72fa19220 call 7ff72fa52310 1573->1607 1615 7ff72f9e8c7e 1574->1615 1616 7ff72f9e8c77-7ff72f9e8c7c 1574->1616 1625 7ff72f9e8e62-7ff72f9e8ee3 call 7ff72f9d0450 call 7ff72fa18e90 call 7ff72fa3a800 call 7ff72f9d3680 1607->1625 1626 7ff72f9e8fbb-7ff72f9e9074 call 7ff72f9d10b0 call 7ff72fa19220 call 7ff72f9cd210 call 7ff72f9d11a0 call 7ff72f9d56a0 call 7ff72f9d5160 call 7ff72f9d3c10 call 7ff72f9d3680 1607->1626 1618 7ff72f9e8c83-7ff72f9e8c8e 1615->1618 1616->1618 1618->1607 1644 7ff72f9e8ee5-7ff72f9e8ef1 1625->1644 1645 7ff72f9e8ef3-7ff72f9e8efa 1625->1645 1661 7ff72f9e907b-7ff72f9e9184 call 7ff72f9d0450 call 7ff72fa18e90 call 7ff72f9d10b0 call 7ff72fa19220 call 7ff72fa52310 1626->1661 1647 7ff72f9e8eff-7ff72f9e8fb6 call 7ff72f9d10b0 call 7ff72fa19220 call 7ff72f9cd210 call 7ff72f9d11a0 call 7ff72f9d56a0 call 7ff72f9d5160 call 7ff72f9d3c10 call 7ff72f9d3680 1644->1647 1645->1647 1647->1661 1681 7ff72f9e9290-7ff72f9e9348 call 7ff72f9d10b0 call 7ff72fa19220 call 7ff72f9cd210 call 7ff72f9d11a0 call 7ff72f9d56a0 call 7ff72f9d5160 call 7ff72f9d3c10 call 7ff72f9d3680 1661->1681 1682 7ff72f9e918a-7ff72f9e928b call 7ff72f9f04f0 call 7ff72f9d10b0 call 7ff72fa19220 call 7ff72f9cd210 call 7ff72f9d11a0 call 7ff72f9d56a0 call 7ff72f9d5040 call 7ff72f9d3c10 call 7ff72f9d3680 call 7ff72f9d3c10 1661->1682 1716 7ff72f9e9349-7ff72f9e9425 call 7ff72f9d3680 * 2 call 7ff72f9d3c10 * 13 1681->1716 1682->1716
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72F9D11A0: _WChar_traits.LIBCPMTD ref: 00007FF72F9D11CD
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA198A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF72FA19930
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA198A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72FA1995D
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA198A0: shared_ptr.LIBCMTD ref: 00007FF72FA19993
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA198A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72FA19A2E
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA18E90: shared_ptr.LIBCMTD ref: 00007FF72FA18F05
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA18E90: shared_ptr.LIBCMTD ref: 00007FF72FA18F8E
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72F9D10B0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72F9D10CD
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA52310: RegCreateKeyW.ADVAPI32 ref: 00007FF72FA52347
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA52310: RegQueryValueExW.KERNEL32 ref: 00007FF72FA52392
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA52310: RegCloseKey.ADVAPI32 ref: 00007FF72FA523A1
                                                                                                                                                                                                                                            • type_info::_name_internal_method.LIBCMTD ref: 00007FF72F9E6FA7
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA18E90: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72FA19190
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA3A800: std::ios_base::good.LIBCPMTD ref: 00007FF72FA3A9E1
                                                                                                                                                                                                                                            • type_info::_name_internal_method.LIBCMTD ref: 00007FF72F9E6EE9
                                                                                                                                                                                                                                            • type_info::_name_internal_method.LIBCMTD ref: 00007FF72F9E729A
                                                                                                                                                                                                                                            • type_info::_name_internal_method.LIBCMTD ref: 00007FF72F9E758D
                                                                                                                                                                                                                                            • type_info::_name_internal_method.LIBCMTD ref: 00007FF72F9E7879
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA52310: RegCloseKey.KERNEL32 ref: 00007FF72FA523CD
                                                                                                                                                                                                                                            • type_info::_name_internal_method.LIBCMTD ref: 00007FF72F9E7E65
                                                                                                                                                                                                                                            • type_info::_name_internal_method.LIBCMTD ref: 00007FF72F9E8158
                                                                                                                                                                                                                                            • type_info::_name_internal_method.LIBCMTD ref: 00007FF72F9E844B
                                                                                                                                                                                                                                            • type_info::_name_internal_method.LIBCMTD ref: 00007FF72F9E8744
                                                                                                                                                                                                                                            • type_info::_name_internal_method.LIBCMTD ref: 00007FF72F9E8A37
                                                                                                                                                                                                                                            • type_info::_name_internal_method.LIBCMTD ref: 00007FF72F9E8D2A
                                                                                                                                                                                                                                            • type_info::_name_internal_method.LIBCMTD ref: 00007FF72F9E8F94
                                                                                                                                                                                                                                            • type_info::_name_internal_method.LIBCMTD ref: 00007FF72F9E9052
                                                                                                                                                                                                                                            • type_info::_name_internal_method.LIBCMTD ref: 00007FF72F9E7B72
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72F9D5040: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72F9D506B
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72F9D5040: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72F9D507A
                                                                                                                                                                                                                                            • type_info::_name_internal_method.LIBCMTD ref: 00007FF72F9E9327
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: type_info::_name_internal_method$Concurrency::details::EmptyQueue::StructuredWork$shared_ptr$Close$Char_traitsCreateQueryValuestd::ios_base::good
                                                                                                                                                                                                                                            • String ID: PCAppStore$PCAppStoreUpdater$auto_start_on$browser_activity$browser_search$btn_x_close$contextual_offers$hardware_collecting$link_substitution$periodical_offers$personilized_notifications$search_menu$should_auto_update$software_collecting$start_menu_on
                                                                                                                                                                                                                                            • API String ID: 2434849288-4189071652
                                                                                                                                                                                                                                            • Opcode ID: 4c8b69f282f4b6e79792ba3f6844c1a425e09e84a634fb77b23f9a7e87a2d60b
                                                                                                                                                                                                                                            • Instruction ID: 31c69cedf3695fd78c5eaaed3280d5d9b89b5728423b710cfde9125733481780
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 4c8b69f282f4b6e79792ba3f6844c1a425e09e84a634fb77b23f9a7e87a2d60b
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: C433B53260DAC194EA70AB55E8906EBB3A4FBC9780F905136D6CD83B5EDE2CD584CF50
                                                                                                                                                                                                                                            Function 00007FF72F9DB130 Relevance: 47.9, APIs: 13, Strings: 14, Instructions: 636registryCOMMON
                                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                                            control_flow_graph 1750 7ff72f9db130-7ff72f9db23b call 7ff72f9d11a0 call 7ff72fa198a0 call 7ff72f9d0450 call 7ff72fa18e90 call 7ff72f9cd210 call 7ff72f9d3680 RegisterClassExW 1763 7ff72f9db24d-7ff72f9db348 call 7ff72f9d0450 call 7ff72fa18e90 call 7ff72f9cd210 CreateWindowExW call 7ff72f9d3680 1750->1763 1764 7ff72f9db23d-7ff72f9db248 call 7ff72f9d3680 1750->1764 1776 7ff72f9db35a-7ff72f9db5ba ShowWindow call 7ff72fbe2956 call 7ff72f9d1200 call 7ff72f9ec710 call 7ff72f9ec1b0 call 7ff72f9d1200 call 7ff72f9d11a0 call 7ff72fa198a0 call 7ff72f9d11a0 call 7ff72fa198a0 call 7ff72f9d0450 call 7ff72fa18e90 call 7ff72f9d0450 call 7ff72fa18e90 call 7ff72f9d5950 call 7ff72f9d5880 call 7ff72f9d3680 * 3 1763->1776 1777 7ff72f9db34a-7ff72f9db355 call 7ff72f9d3680 1763->1777 1769 7ff72f9dc03b-7ff72f9dc043 1764->1769 1816 7ff72f9db5bb-7ff72f9db5cc 1776->1816 1777->1769 1817 7ff72f9db5d2-7ff72f9db633 call 7ff72f9d50c0 GetForegroundWindow call 7ff72f9e3200 GetWindowTextW call 7ff72f9e60e0 1816->1817 1818 7ff72f9dbfd8-7ff72f9dc03a call 7ff72fbe295c call 7ff72f9d3680 * 3 call 7ff72f9d3c10 * 2 call 7ff72f9d3680 1816->1818 1832 7ff72f9db635-7ff72f9db64e call 7ff72f9e60e0 1817->1832 1833 7ff72f9db662-7ff72f9db68c PeekMessageW 1817->1833 1818->1769 1832->1833 1849 7ff72f9db650-7ff72f9db659 1832->1849 1834 7ff72f9db692-7ff72f9db6ba TranslateMessage DispatchMessageW 1833->1834 1835 7ff72f9dbe21-7ff72f9dbe2c SleepEx 1833->1835 1838 7ff72f9db6c0-7ff72f9dba68 call 7ff72f9d11a0 call 7ff72fa198a0 call 7ff72f9d11a0 call 7ff72fa198a0 call 7ff72f9d11a0 call 7ff72fa198a0 call 7ff72f9d0510 * 2 call 7ff72f9d0450 call 7ff72fa18e90 call 7ff72f9d0450 call 7ff72fa18e90 call 7ff72f9d0450 call 7ff72fa18e90 call 7ff72fa5d350 call 7ff72f9d3680 * 5 call 7ff72f9ed500 call 7ff72f9d11a0 call 7ff72fa198a0 call 7ff72f9d0450 call 7ff72fa18e90 call 7ff72f9e3b30 call 7ff72f9d3680 * 5 1834->1838 1839 7ff72f9dba6d-7ff72f9dba78 1834->1839 1840 7ff72f9dbe2d-7ff72f9dbe36 1835->1840 1843 7ff72f9dbe1f 1838->1843 1839->1843 1844 7ff72f9dba7e-7ff72f9dbe1e call 7ff72f9d11a0 call 7ff72fa198a0 call 7ff72f9d11a0 call 7ff72fa198a0 call 7ff72f9d11a0 call 7ff72fa198a0 call 7ff72f9d0510 * 2 call 7ff72f9d0450 call 7ff72fa18e90 call 7ff72f9d0450 call 7ff72fa18e90 call 7ff72f9d0450 call 7ff72fa18e90 call 7ff72fa5d350 call 7ff72f9d3680 * 5 call 7ff72f9d11a0 call 7ff72fa198a0 call 7ff72f9d0450 call 7ff72fa18e90 call 7ff72f9e3b30 call 7ff72f9d3680 * 5 1839->1844 1845 7ff72f9dbe51-7ff72f9dbe7c call 7ff72f9cd210 OpenEventW 1840->1845 1846 7ff72f9dbe38 1840->1846 1843->1840 1844->1843 1865 7ff72f9dbfd3 1845->1865 1866 7ff72f9dbe82-7ff72f9dbe94 WaitForSingleObject 1845->1866 1852 7ff72f9dbe38 call 7ff72fa3ab70 1846->1852 1849->1833 1855 7ff72f9db65b 1849->1855 1857 7ff72f9dbe3d-7ff72f9dbe42 1852->1857 1855->1833 1863 7ff72f9dbe44 call 7ff72fa55130 1857->1863 1864 7ff72f9dbe4a 1857->1864 1875 7ff72f9dbe49 1863->1875 1864->1845 1865->1816 1866->1865 1871 7ff72f9dbe9a-7ff72f9dbfd2 call 7ff72f9d11a0 call 7ff72fa198a0 call 7ff72f9cd210 call 7ff72f9d11a0 call 7ff72f9d3680 call 7ff72f9d10b0 call 7ff72fa19220 call 7ff72fa6db90 CloseHandle call 7ff72f9d3c10 1866->1871 1871->1865 1875->1864
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72F9D11A0: _WChar_traits.LIBCPMTD ref: 00007FF72F9D11CD
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA198A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF72FA19930
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA198A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72FA1995D
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA198A0: shared_ptr.LIBCMTD ref: 00007FF72FA19993
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA198A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72FA19A2E
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA18E90: shared_ptr.LIBCMTD ref: 00007FF72FA18F05
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA18E90: shared_ptr.LIBCMTD ref: 00007FF72FA18F8E
                                                                                                                                                                                                                                            • RegisterClassExW.USER32 ref: 00007FF72F9DB230
                                                                                                                                                                                                                                            • CreateWindowExW.USER32 ref: 00007FF72F9DB31B
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: shared_ptr$Concurrency::details::EmptyQueue::StructuredWork$Char_traitsClassCreateRegisterWindowtype_info::_name_internal_method
                                                                                                                                                                                                                                            • String ID: ENDING_EVT_HANDLER$Local$P$PCAppStore$Windows Default Lock Screen$logoff$msg=logoff$msg=shutdown$product$product$shutdown$system_event$system_event${"app":{"menu_search":{"search_request":"", "page":"b"},"show_window": "menu_search"}}
                                                                                                                                                                                                                                            • API String ID: 331722943-4236414880
                                                                                                                                                                                                                                            • Opcode ID: 0754f130fd34716fcdb0cd7331e2025a70f820c8ce696dc9b058b7ba823ede7d
                                                                                                                                                                                                                                            • Instruction ID: 2f1c2884dd8cd9b3cd2a8cc5e3992316fb96c9efa3f1e45d7a251e083aede507
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 0754f130fd34716fcdb0cd7331e2025a70f820c8ce696dc9b058b7ba823ede7d
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 0272C432609AC191EA70AB15E8947EBB364FBC9740F905136D6CD83BA9EF2CD544CF50
                                                                                                                                                                                                                                            Function 00007FF72FBA5A90 Relevance: 42.4, APIs: 1, Strings: 23, Instructions: 439COMMON
                                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72F9D11A0: _WChar_traits.LIBCPMTD ref: 00007FF72F9D11CD
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA198A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF72FA19930
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA198A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72FA1995D
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA198A0: shared_ptr.LIBCMTD ref: 00007FF72FA19993
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA198A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72FA19A2E
                                                                                                                                                                                                                                            • std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FF72FBA6279
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA17E60: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72FA17EF7
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Concurrency::details::EmptyQueue::StructuredWork$Char_traitsFac_nodeFac_node::_shared_ptrstd::_type_info::_name_internal_method
                                                                                                                                                                                                                                            • String ID: ClassGuid$CompatID$Description$DevLoader$DeviceClass$DeviceID$DeviceName$DriverDate$DriverName$DriverProviderName$DriverVersion$FriendlyName$HardWareID$InfName$Location$Manufacturer$Name$PDO$Signer$StartMode$Status$SystemCreationClassName$SystemName
                                                                                                                                                                                                                                            • API String ID: 2107158585-2483722238
                                                                                                                                                                                                                                            • Opcode ID: 8c260451b63478c5472073a849fbd9922c3ea5908b3a5f8ad396fb279bfc1166
                                                                                                                                                                                                                                            • Instruction ID: c1b6f60576b8c362fcc19f59430c77769d34dcfac086f9d21ad12b1c57940093
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 8c260451b63478c5472073a849fbd9922c3ea5908b3a5f8ad396fb279bfc1166
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 09321D3260DAC2A1EA70BB54E8956EEA365FBC5340FC15136D6CC82BADEE2CD545CF10
                                                                                                                                                                                                                                            Function 00007FF72FB82C40 Relevance: 35.9, APIs: 10, Strings: 10, Instructions: 897COMMON
                                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                                            control_flow_graph 2202 7ff72fb82c40-7ff72fb83138 call 7ff72f9d11a0 call 7ff72fa198a0 call 7ff72f9cd210 call 7ff72f9d11a0 call 7ff72f9d3680 call 7ff72f9d11a0 call 7ff72fa198a0 call 7ff72f9cd210 call 7ff72f9d11a0 call 7ff72f9d3680 call 7ff72f9d11a0 call 7ff72fa198a0 call 7ff72f9cd210 call 7ff72f9d11a0 call 7ff72f9d3680 call 7ff72f9d11a0 call 7ff72fa198a0 call 7ff72f9cd210 call 7ff72f9d11a0 call 7ff72f9d3680 call 7ff72f9d11a0 call 7ff72fa198a0 call 7ff72f9cd210 call 7ff72f9d11a0 call 7ff72f9d3680 call 7ff72f9d11a0 call 7ff72fa198a0 call 7ff72f9cd210 call 7ff72f9d11a0 call 7ff72f9d3680 call 7ff72f9d11a0 call 7ff72fa198a0 call 7ff72f9cd210 call 7ff72f9d11a0 call 7ff72f9d3680 call 7ff72f9d13f0 call 7ff72f9d10b0 call 7ff72fa19220 call 7ff72f9d10b0 call 7ff72fa19220 call 7ff72fa52420 call 7ff72f9cd210 call 7ff72fbe9110 2289 7ff72fb8314b-7ff72fb83152 2202->2289 2290 7ff72fb8313a-7ff72fb83149 2202->2290 2291 7ff72fb8315a-7ff72fb8334d call 7ff72f9d10b0 call 7ff72fa19220 call 7ff72f9da530 call 7ff72f9d11a0 call 7ff72f9d56a0 call 7ff72f9d5160 call 7ff72f9d3c10 call 7ff72f9d3680 * 2 call 7ff72f9d10b0 call 7ff72fa19220 call 7ff72f9d10b0 call 7ff72fa19220 call 7ff72fa52420 call 7ff72f9cd210 call 7ff72fbe9110 2289->2291 2290->2291 2324 7ff72fb83359 2291->2324 2325 7ff72fb8334f-7ff72fb83357 2291->2325 2326 7ff72fb83361-7ff72fb834a5 call 7ff72f9d3680 call 7ff72f9d10b0 call 7ff72fa19220 call 7ff72f9d10b0 call 7ff72fa19220 call 7ff72fa52420 call 7ff72f9cd210 call 7ff72fbe9110 2324->2326 2325->2326 2343 7ff72fb834a7-7ff72fb834af 2326->2343 2344 7ff72fb834b1 2326->2344 2345 7ff72fb834b9-7ff72fb835fd call 7ff72f9d3680 call 7ff72f9d10b0 call 7ff72fa19220 call 7ff72f9d10b0 call 7ff72fa19220 call 7ff72fa52420 call 7ff72f9cd210 call 7ff72fbe9110 2343->2345 2344->2345 2362 7ff72fb83609 2345->2362 2363 7ff72fb835ff-7ff72fb83607 2345->2363 2364 7ff72fb83611-7ff72fb8362c call 7ff72f9d3680 2362->2364 2363->2364 2367 7ff72fb8362e-7ff72fb8363d 2364->2367 2368 7ff72fb8363f-7ff72fb83646 2364->2368 2369 7ff72fb8364e-7ff72fb8370a call 7ff72f9d10b0 call 7ff72fa19220 call 7ff72f9da530 call 7ff72f9d11a0 call 7ff72f9d56a0 call 7ff72f9d5160 call 7ff72f9d3c10 call 7ff72f9d3680 2367->2369 2368->2369 2386 7ff72fb8371d-7ff72fb83724 2369->2386 2387 7ff72fb8370c-7ff72fb8371b 2369->2387 2388 7ff72fb8372c-7ff72fb837e8 call 7ff72f9d10b0 call 7ff72fa19220 call 7ff72f9da530 call 7ff72f9d11a0 call 7ff72f9d56a0 call 7ff72f9d5160 call 7ff72f9d3c10 call 7ff72f9d3680 2386->2388 2387->2388 2405 7ff72fb837fb-7ff72fb83802 2388->2405 2406 7ff72fb837ea-7ff72fb837f9 2388->2406 2407 7ff72fb8380a-7ff72fb838cc call 7ff72f9d10b0 call 7ff72fa19220 call 7ff72f9da530 call 7ff72f9d11a0 call 7ff72f9d56a0 call 7ff72f9d5160 call 7ff72f9d3c10 call 7ff72f9d3680 2405->2407 2406->2407 2424 7ff72fb83bf9-7ff72fb83d6e call 7ff72f9d0c10 call 7ff72f9d10b0 call 7ff72fa19220 call 7ff72f9d10b0 call 7ff72fa19220 call 7ff72fa52310 call 7ff72f9d54e0 call 7ff72f9d52b0 call 7ff72f9f0350 call 7ff72f9ea8b0 2407->2424 2425 7ff72fb838d2-7ff72fb83aef call 7ff72f9d11a0 call 7ff72fa198a0 call 7ff72f9cd210 call 7ff72f9d11a0 call 7ff72f9d3680 call 7ff72f9d11a0 call 7ff72fa198a0 call 7ff72f9cd210 call 7ff72f9d11a0 call 7ff72f9d3680 call 7ff72f9d10b0 call 7ff72fa19220 call 7ff72f9d10b0 call 7ff72fa19220 call 7ff72fa52310 2407->2425 2467 7ff72fb83e05-7ff72fb83e16 call 7ff72f9ea8b0 2424->2467 2468 7ff72fb83d74-7ff72fb83d9d call 7ff72f9ea8b0 2424->2468 2504 7ff72fb83af8 2425->2504 2505 7ff72fb83af1-7ff72fb83af6 2425->2505 2477 7ff72fb83e1c-7ff72fb83f00 call 7ff72f9cbc20 call 7ff72f9e5ce0 call 7ff72f9e3140 call 7ff72f9d5830 call 7ff72f9c97a0 call 7ff72f9d5040 call 7ff72f9d3c10 2467->2477 2478 7ff72fb83f01-7ff72fb840c5 call 7ff72f9d10b0 call 7ff72fa19220 call 7ff72f9da530 call 7ff72f9d11a0 call 7ff72f9d56a0 call 7ff72f9d50c0 call 7ff72f9d3c10 call 7ff72f9d3680 call 7ff72f9d05d0 call 7ff72f9d10b0 call 7ff72fa19220 call 7ff72fb815d0 * 2 call 7ff72fb815a0 call 7ff72fb815d0 call 7ff72f9c9ef0 call 7ff72fb815d0 call 7ff72f9d3680 2467->2478 2475 7ff72fb83dac-7ff72fb83db9 2468->2475 2479 7ff72fb83dbb-7ff72fb83dfe call 7ff72f9e3140 call 7ff72f9e9be0 2475->2479 2480 7ff72fb83e00 2475->2480 2477->2478 2568 7ff72fb840c7-7ff72fb840cf 2478->2568 2569 7ff72fb840d1 2478->2569 2479->2475 2480->2478 2508 7ff72fb83afd-7ff72fb83b04 2504->2508 2505->2508 2511 7ff72fb83b17-7ff72fb83b1e 2508->2511 2512 7ff72fb83b06-7ff72fb83b15 2508->2512 2515 7ff72fb83b26-7ff72fb83bf8 call 7ff72f9d10b0 call 7ff72fa19220 call 7ff72f9cd210 call 7ff72f9d11a0 call 7ff72f9d56a0 call 7ff72f9d5160 call 7ff72f9d3c10 call 7ff72f9d3680 call 7ff72f9d3c10 * 2 2511->2515 2512->2515 2515->2424 2570 7ff72fb840d9-7ff72fb84202 call 7ff72fa726a0 call 7ff72f9d0450 call 7ff72fa6db90 call 7ff72f9d3680 call 7ff72f9d3c10 call 7ff72f9d7240 call 7ff72f9d3d60 call 7ff72f9d3c10 * 7 2568->2570 2569->2570
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72F9D11A0: _WChar_traits.LIBCPMTD ref: 00007FF72F9D11CD
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA198A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF72FA19930
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA198A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72FA1995D
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA198A0: shared_ptr.LIBCMTD ref: 00007FF72FA19993
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA198A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72FA19A2E
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72F9D10B0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72F9D10CD
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA52420: RegCreateKeyW.ADVAPI32 ref: 00007FF72FA52470
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA52420: strrchr.LIBCMTD ref: 00007FF72FA52487
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA52420: RegQueryValueExW.KERNEL32 ref: 00007FF72FA524D3
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA52420: RegCloseKey.KERNEL32 ref: 00007FF72FA524ED
                                                                                                                                                                                                                                            • type_info::_name_internal_method.LIBCMTD ref: 00007FF72FB831EF
                                                                                                                                                                                                                                            • type_info::_name_internal_method.LIBCMTD ref: 00007FF72FB836E3
                                                                                                                                                                                                                                            • type_info::_name_internal_method.LIBCMTD ref: 00007FF72FB837C1
                                                                                                                                                                                                                                            • type_info::_name_internal_method.LIBCMTD ref: 00007FF72FB83BBB
                                                                                                                                                                                                                                            • type_info::_name_internal_method.LIBCMTD ref: 00007FF72FB8389F
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA52310: RegCreateKeyW.ADVAPI32 ref: 00007FF72FA52347
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA52310: RegQueryValueExW.KERNEL32 ref: 00007FF72FA52392
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA52310: RegCloseKey.ADVAPI32 ref: 00007FF72FA523A1
                                                                                                                                                                                                                                            • UnDecorator::getVbTableType.LIBCMTD ref: 00007FF72FB84039
                                                                                                                                                                                                                                            • UnDecorator::getVbTableType.LIBCMTD ref: 00007FF72FB84048
                                                                                                                                                                                                                                            • UnDecorator::getVbTableType.LIBCMTD ref: 00007FF72FB84065
                                                                                                                                                                                                                                            • UnDecorator::getVbTableType.LIBCMTD ref: 00007FF72FB84074
                                                                                                                                                                                                                                            • UnDecorator::getVbTableType.LIBCMTD ref: 00007FF72FB84090
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: type_info::_name_internal_method$Decorator::getTableType$Concurrency::details::EmptyQueue::StructuredWork$CloseCreateQueryValue$Char_traitsshared_ptrstrrchr
                                                                                                                                                                                                                                            • String ID: ColorPrevalence$ColorizationColor$EnableTransparency$Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced$Software\Microsoft\Windows\CurrentVersion\Themes\Personalize$Software\Microsoft\Windows\DWM$SystemUsesLightTheme$TaskbarAl$theme_parameter${"app" : {
                                                                                                                                                                                                                                            • API String ID: 3722789660-4154301006
                                                                                                                                                                                                                                            • Opcode ID: e8f89364b004bbd1752be5bf697cbdd49eae34f1fa282b9586a2c79d0e640d75
                                                                                                                                                                                                                                            • Instruction ID: 079c2183d8a45961411dd13f2f2a5923d4721b639fb53e13226ca5f60629ebc4
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: e8f89364b004bbd1752be5bf697cbdd49eae34f1fa282b9586a2c79d0e640d75
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 52B2C77260DAC195EAB0AB14E8942EBB3A4EBC9780F905136D6CD83B59DF3CD584CF50
                                                                                                                                                                                                                                            Function 00007FF72F9DC290 Relevance: 34.6, APIs: 6, Strings: 13, Instructions: 1383COMMON
                                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                                            control_flow_graph 2599 7ff72f9dc290-7ff72f9dc718 call 7ff72fbe2f90 call 7ff72f9ea0d0 call 7ff72f9ed500 call 7ff72f9d11a0 call 7ff72fa198a0 call 7ff72f9d11a0 call 7ff72fa198a0 call 7ff72f9d11a0 call 7ff72fa198a0 call 7ff72f9d11a0 call 7ff72fa198a0 call 7ff72f9d11a0 call 7ff72fa198a0 call 7ff72f9d11a0 call 7ff72fa198a0 call 7ff72f9cd210 call 7ff72f9d11a0 call 7ff72f9d3680 call 7ff72f9d11a0 call 7ff72fa198a0 call 7ff72f9d05d0 call 7ff72fa3a6b0 call 7ff72f9cd210 * 2 call 7ff72f9da250 call 7ff72f9d3680 call 7ff72f9d0510 * 2 call 7ff72f9d0450 call 7ff72fa18e90 call 7ff72f9d0450 call 7ff72fa18e90 call 7ff72fa5ca30 call 7ff72f9d3680 * 4 call 7ff72f9c8ad0 call 7ff72f9e48d0 call 7ff72f9d8790 2680 7ff72f9dc71e-7ff72f9dc804 call 7ff72f9d0450 call 7ff72fa18e90 call 7ff72f9e3b30 call 7ff72f9d3680 call 7ff72f9d4e10 call 7ff72f9d3680 * 2 call 7ff72f9d3c10 call 7ff72f9d3680 * 5 2599->2680 2681 7ff72f9dc809-7ff72f9dc818 call 7ff72fa52f10 call 7ff72f9eb220 2599->2681 2770 7ff72f9de29b-7ff72f9de2a2 2680->2770 2690 7ff72f9dc819-7ff72f9dc82c call 7ff72fa6e340 2681->2690 2697 7ff72f9dca43-7ff72f9dca6e call 7ff72f9ecdd0 call 7ff72f9e97e0 call 7ff72f9eb220 2690->2697 2698 7ff72f9dc832-7ff72f9dc843 2690->2698 2719 7ff72f9dca73-7ff72f9dca86 call 7ff72fa6d2d0 2697->2719 2698->2697 2701 7ff72f9dc849-7ff72f9dc891 call 7ff72f9eb220 call 7ff72f9ca520 call 7ff72f9c9a20 call 7ff72f9e4400 2698->2701 2726 7ff72f9dca11-7ff72f9dca38 call 7ff72fa6d390 call 7ff72f9d7d40 call 7ff72f9cfed0 2701->2726 2727 7ff72f9dc897-7ff72f9dca0c call 7ff72f9d0450 call 7ff72fa18e90 call 7ff72f9e3340 call 7ff72f9d3680 call 7ff72fa52f10 call 7ff72f9d0450 call 7ff72fa18e90 call 7ff72f9e3b30 call 7ff72f9d3680 call 7ff72f9ebd30 call 7ff72f9d4e10 call 7ff72f9d3680 * 2 call 7ff72f9d3c10 call 7ff72f9d3680 * 5 2701->2727 2729 7ff72f9dca8c-7ff72f9dca9d 2719->2729 2730 7ff72f9dcc8b-7ff72f9dcf0d call 7ff72f9d02f0 call 7ff72f9c93b0 call 7ff72fbaf450 call 7ff72fbaf480 call 7ff72f9d0510 * 3 call 7ff72f9d10b0 call 7ff72fa19220 call 7ff72f9d0450 call 7ff72fa18e90 call 7ff72fa5ca30 call 7ff72f9d3680 * 5 call 7ff72f9d0450 call 7ff72fa18e90 call 7ff72fa6db90 2719->2730 2757 7ff72f9dca3d-7ff72f9dca3e 2726->2757 2727->2770 2729->2730 2731 7ff72f9dcaa3-7ff72f9dcaeb call 7ff72f9eb220 call 7ff72f9ca520 call 7ff72f9c9a20 call 7ff72f9e4400 2729->2731 2870 7ff72f9dcf0f-7ff72f9dcf78 call 7ff72f9d4e10 call 7ff72f9d3680 * 2 call 7ff72f9d3c10 call 7ff72f9d3680 * 5 2730->2870 2871 7ff72f9dcf7d-7ff72f9dd513 call 7ff72f9cd210 call 7ff72fa001e0 call 7ff72f9cbc20 call 7ff72fa8a2b0 call 7ff72f9d4730 call 7ff72f9cd210 call 7ff72fa01a90 call 7ff72f9cbc20 call 7ff72fa8a0c0 call 7ff72f9d4730 call 7ff72f9cd210 * 2 call 7ff72fa6a070 call 7ff72f9cbc20 call 7ff72fa8a0c0 call 7ff72f9d4730 call 7ff72f9cd210 call 7ff72fa6fd90 call 7ff72f9cbc20 call 7ff72fa8a2b0 call 7ff72f9d4730 call 7ff72f9cd210 * 2 call 7ff72fa738c0 call 7ff72f9cbc20 call 7ff72fa8a160 call 7ff72f9d4730 call 7ff72f9cd210 * 2 call 7ff72fa78be0 call 7ff72f9cbc20 call 7ff72fa8a2b0 call 7ff72f9d4730 call 7ff72f9cd210 call 7ff72fa79bc0 call 7ff72f9cbc20 call 7ff72fa8a2b0 call 7ff72f9d4730 call 7ff72f9cd210 call 7ff72fa7ff90 call 7ff72f9cbc20 call 7ff72fa8a2b0 call 7ff72f9d4730 call 7ff72f9cd210 * 2 call 7ff72fa8ea80 call 7ff72f9cbc20 call 7ff72fa8a160 call 7ff72f9d4730 2730->2871 2774 7ff72f9dcaf1-7ff72f9dcc66 call 7ff72f9d0450 call 7ff72fa18e90 call 7ff72f9e3340 call 7ff72f9d3680 call 7ff72fa52f10 call 7ff72f9d0450 call 7ff72fa18e90 call 7ff72f9e3b30 call 7ff72f9d3680 call 7ff72f9ebd30 call 7ff72f9d4e10 call 7ff72f9d3680 * 2 call 7ff72f9d3c10 call 7ff72f9d3680 * 5 2731->2774 2775 7ff72f9dcc6b-7ff72f9dcc86 call 7ff72f9d7d40 call 7ff72f9cfed0 2731->2775 2757->2690 2774->2770 2775->2719 2870->2770 2995 7ff72f9dd515-7ff72f9dd523 call 7ff72f9e9dd0 2871->2995 2996 7ff72f9dd528-7ff72f9dd574 call 7ff72f9cd210 * 2 call 7ff72fb7f510 2871->2996 3001 7ff72f9dd5ca-7ff72f9dd96d call 7ff72f9cd210 * 2 call 7ff72fb7cd30 call 7ff72f9cbc20 call 7ff72fa8a0c0 call 7ff72f9d4730 call 7ff72f9cd210 * 2 call 7ff72fb84210 call 7ff72f9cbc20 call 7ff72fa8a160 call 7ff72f9d4730 call 7ff72f9cd210 * 2 call 7ff72fb92560 call 7ff72f9cbc20 call 7ff72fa8a2b0 call 7ff72f9d4730 call 7ff72f9cd210 call 7ff72fb95180 call 7ff72f9cbc20 call 7ff72fa8a2b0 call 7ff72f9d4730 call 7ff72f9cd210 call 7ff72fa8ab80 call 7ff72f9d11a0 call 7ff72fa198a0 call 7ff72f9cd210 call 7ff72f9d11a0 call 7ff72f9d3680 call 7ff72fb93e60 call 7ff72f9c8ad0 call 7ff72f9e48d0 call 7ff72f9c8ad0 2995->3001 3008 7ff72f9dd579-7ff72f9dd5c9 call 7ff72f9cbc20 call 7ff72fa8a0c0 call 7ff72f9d4730 2996->3008 3079 7ff72f9dd972-7ff72f9dda53 call 7ff72f9e48d0 call 7ff72f9d10b0 call 7ff72fa19220 call 7ff72fa6db90 WaitForSingleObject call 7ff72fbaf4d0 3001->3079 3008->3001 3090 7ff72f9de1a5-7ff72f9de1f8 call 7ff72fa6d420 call 7ff72fa52f10 call 7ff72f9e62c0 ResetEvent 3079->3090 3091 7ff72f9dda59-7ff72f9dda75 WaitForSingleObject 3079->3091 3105 7ff72f9de208-7ff72f9de29a call 7ff72f9d4e10 * 2 call 7ff72f9d3c10 call 7ff72f9d4e10 call 7ff72f9d3680 * 2 call 7ff72f9d3c10 call 7ff72f9d3680 * 5 3090->3105 3106 7ff72f9de1fa-7ff72f9de207 call 7ff72f9ebd30 3090->3106 3092 7ff72f9de180-7ff72f9de1a4 CloseHandle * 2 3091->3092 3093 7ff72f9dda7b-7ff72f9ddd19 call 7ff72f9d11a0 call 7ff72fa198a0 call 7ff72f9d11a0 call 7ff72fa198a0 call 7ff72f9cd210 call 7ff72f9d11a0 call 7ff72f9d3680 call 7ff72f9d10b0 call 7ff72fa19220 call 7ff72f9d0510 call 7ff72f9d10b0 call 7ff72fa19220 call 7ff72f9d0450 call 7ff72fa18e90 call 7ff72fa5cb80 call 7ff72fa7b750 3091->3093 3092->3090 3160 7ff72f9ddf40-7ff72f9ddf45 3093->3160 3161 7ff72f9ddd1f-7ff72f9ddf3b call 7ff72f9d11a0 call 7ff72fa198a0 call 7ff72f9cd210 call 7ff72f9d11a0 call 7ff72f9d3680 call 7ff72f9d0510 * 3 call 7ff72f9d10b0 call 7ff72fa19220 call 7ff72f9d0450 call 7ff72fa18e90 call 7ff72fa5d350 call 7ff72f9d3680 * 5 call 7ff72f9d3c10 3093->3161 3105->2770 3106->3105 3163 7ff72f9ddf4b-7ff72f9de166 call 7ff72f9d11a0 call 7ff72fa198a0 call 7ff72f9cd210 call 7ff72f9d11a0 call 7ff72f9d3680 call 7ff72f9d0510 * 3 call 7ff72f9d10b0 call 7ff72fa19220 call 7ff72f9d0450 call 7ff72fa18e90 call 7ff72fa5d350 call 7ff72f9d3680 * 5 call 7ff72f9d3c10 3160->3163 3164 7ff72f9de167-7ff72f9de17f call 7ff72f9d3c10 call 7ff72f9d3680 3160->3164 3161->3164 3163->3164 3164->3092
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Concurrency::details::EmptyQueue::StructuredWorkshared_ptr$Cpp_errorDecorator::getNameTableThrow_Typestd::_$Char_traitsCloseDefaultFileLanguageLocaleModuleOpenThrd_detachUserValuetype_info::_name_internal_method
                                                                                                                                                                                                                                            • String ID: prnt=%ws&sys_lang=%ws$product$product$started$ui_closing_failed$ui_closing_timeout$ui_creation_error$ui_not_found$waiting_for_UI_connection$waiting_for_windows_creation$windows_created${"app" : {"show_window":"main"}}${"app": {"init": {"userInit": true}}}
                                                                                                                                                                                                                                            • API String ID: 2904651881-622979156
                                                                                                                                                                                                                                            • Opcode ID: ff0abc8baa323f9612b8508f6073eb51e73b4ab37d92c127255c549e3a467bd7
                                                                                                                                                                                                                                            • Instruction ID: e781976da1b3beb5f1f540fa8109168ab7df1044c9ccaa63dab0d0719c608e3c
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: ff0abc8baa323f9612b8508f6073eb51e73b4ab37d92c127255c549e3a467bd7
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: ACF2DA32A0DAC191EA70AB15E8913EFA364FBC5780F801536D6CD83BAADE2CD555CF50
                                                                                                                                                                                                                                            Function 00007FF72FB84210 Relevance: 28.5, APIs: 7, Strings: 9, Instructions: 477COMMON
                                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                                            control_flow_graph 3348 7ff72fb84210-7ff72fb84236 3349 7ff72fb84238-7ff72fb84245 3348->3349 3350 7ff72fb84247-7ff72fb84267 call 7ff72fa68880 3348->3350 3349->3350 3351 7ff72fb8426c-7ff72fb84507 call 7ff72fb82c40 call 7ff72f9d11a0 call 7ff72fa198a0 call 7ff72f9d0450 call 7ff72fa18e90 call 7ff72f9cd210 CreateEventW call 7ff72f9d3680 call 7ff72f9d11a0 call 7ff72fa198a0 call 7ff72f9d11a0 call 7ff72fa198a0 call 7ff72f9d11a0 call 7ff72fa198a0 call 7ff72f9d11a0 call 7ff72fa198a0 call 7ff72f9d11a0 call 7ff72fa198a0 call 7ff72f9d11a0 call 7ff72fa198a0 call 7ff72f9d11a0 call 7ff72fa198a0 3349->3351 3355 7ff72fb84e0b-7ff72fb84e12 3350->3355 3397 7ff72fb8450d-7ff72fb846e3 call 7ff72f9d11a0 call 7ff72fa198a0 call 7ff72f9d0450 call 7ff72fa18e90 call 7ff72f9d02f0 call 7ff72fb7fff0 call 7ff72f9d0450 call 7ff72fa18e90 call 7ff72fb80210 call 7ff72f9d3680 * 3 3351->3397 3398 7ff72fb846e4-7ff72fb84cf9 call 7ff72f9d0450 call 7ff72fa18e90 call 7ff72f9d02f0 call 7ff72fb80030 call 7ff72f9d0450 call 7ff72fa18e90 call 7ff72fb80210 call 7ff72f9d3680 * 2 call 7ff72f9d0450 call 7ff72fa18e90 call 7ff72f9d02f0 call 7ff72fb80070 call 7ff72f9d0450 call 7ff72fa18e90 call 7ff72fb80210 call 7ff72f9d3680 * 2 call 7ff72f9d0450 call 7ff72fa18e90 call 7ff72f9d02f0 call 7ff72fb7ffb0 call 7ff72f9d0450 call 7ff72fa18e90 call 7ff72fb80210 call 7ff72f9d3680 * 2 call 7ff72f9d0450 call 7ff72fa18e90 call 7ff72f9d02f0 call 7ff72fb7ff70 call 7ff72f9d0450 call 7ff72fa18e90 call 7ff72fb80210 3351->3398 3397->3398 3490 7ff72fb84cfe-7ff72fb84e03 call 7ff72f9d3680 * 2 call 7ff72f9f12e0 call 7ff72f9d02f0 call 7ff72fb7feb0 call 7ff72fa687a0 call 7ff72f9d4730 call 7ff72f9d3680 * 8 3398->3490 3490->3355
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • CreateEventW.KERNEL32 ref: 00007FF72FB84324
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA198A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF72FA19930
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA198A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72FA1995D
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA198A0: shared_ptr.LIBCMTD ref: 00007FF72FA19993
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA198A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72FA19A2E
                                                                                                                                                                                                                                            • Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 00007FF72FB845E7
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA18E90: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72FA19190
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FB80210: CreateEventW.KERNEL32 ref: 00007FF72FB80238
                                                                                                                                                                                                                                            • Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 00007FF72FB8477F
                                                                                                                                                                                                                                            • Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 00007FF72FB8490F
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72F9D11A0: _WChar_traits.LIBCPMTD ref: 00007FF72F9D11CD
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA18E90: shared_ptr.LIBCMTD ref: 00007FF72FA18F05
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA18E90: shared_ptr.LIBCMTD ref: 00007FF72FA18F8E
                                                                                                                                                                                                                                            • Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 00007FF72FB84A9C
                                                                                                                                                                                                                                            • Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 00007FF72FB84C29
                                                                                                                                                                                                                                            • Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 00007FF72FB84D50
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FB7FEB0: shared_ptr.LIBCMTD ref: 00007FF72FB7FF23
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Concurrency::details::_SchedulerScheduler::_$shared_ptr$Concurrency::details::EmptyQueue::StructuredWork$CreateEvent$Char_traitstype_info::_name_internal_method
                                                                                                                                                                                                                                            • String ID: ClosingEvent$ColorPrevalence$ColorizationColor$EnableTransparency$Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced$Software\Microsoft\Windows\CurrentVersion\Themes\Personalize$Software\Microsoft\Windows\DWM$SystemUsesLightTheme$TaskbarAl
                                                                                                                                                                                                                                            • API String ID: 2878102572-2470191940
                                                                                                                                                                                                                                            • Opcode ID: 15494f6b41dfed4bf20487d672d7749cd29b6a34a7b2f45f4c5f6055bfc8e977
                                                                                                                                                                                                                                            • Instruction ID: 2ce1f8de36faed2a0aad4541f2086600b1ff4ccaf974a33a327ec857c310343a
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 15494f6b41dfed4bf20487d672d7749cd29b6a34a7b2f45f4c5f6055bfc8e977
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: BD52A032609BC195DAB1AB15E8957DBB3A4FBC8780F801126DACC83B69EF38D554CF50
                                                                                                                                                                                                                                            Function 00007FF72FA7C300 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 111memoryCOMMON
                                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Decorator::getTableType$QueryValue$Globalwsprintf$AllocFree
                                                                                                                                                                                                                                            • String ID: \StringFileInfo\%04x%04x\FileDescription$\StringFileInfo\%04x%04x\ProductVersion$\VarFileInfo\Translation
                                                                                                                                                                                                                                            • API String ID: 3623593157-227869778
                                                                                                                                                                                                                                            • Opcode ID: afe8b2dcc620858387f586322b9613184bd3ab54d5df8500ecc911c2893dbe4c
                                                                                                                                                                                                                                            • Instruction ID: d59f5ad0494d3deea4bc343b04a6605ff72c081108dce56fb4b43a9f79c05937
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: afe8b2dcc620858387f586322b9613184bd3ab54d5df8500ecc911c2893dbe4c
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 04512166718A8682EB60EB15E8547FEE360FBC5784F805032EA8E87769DE3CD545CF10
                                                                                                                                                                                                                                            Function 00007FF72FBA0140 Relevance: 23.4, APIs: 3, Strings: 10, Instructions: 662COMMON
                                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                                            control_flow_graph 3552 7ff72fba0140-7ff72fba04a2 call 7ff72f9d0f30 call 7ff72fa19aa0 call 7ff72f9d0f30 call 7ff72fa19aa0 call 7ff72f9d0f30 call 7ff72fa19aa0 call 7ff72f9d0f30 call 7ff72fa19aa0 call 7ff72f9d0f30 call 7ff72fa19aa0 call 7ff72f9d0e90 call 7ff72fa19580 call 7ff72fa5f8f0 call 7ff72fb9caf0 call 7ff72fa588f0 call 7ff72f9f9140 * 2 call 7ff72f9d3be0 call 7ff72f9d1680 call 7ff72fba7830 call 7ff72f9d0e90 call 7ff72fa19580 call 7ff72fa5f8f0 call 7ff72fa588f0 call 7ff72fa4bf80 call 7ff72f9f9140 * 2 call 7ff72f9d3be0 3609 7ff72fba0590-7ff72fba0679 call 7ff72f9d0e90 call 7ff72fa19580 call 7ff72fa5f8f0 call 7ff72fa588f0 call 7ff72fa4bf80 call 7ff72f9f9140 * 2 call 7ff72f9d3be0 3552->3609 3610 7ff72fba04a8-7ff72fba058f call 7ff72f9d0e90 call 7ff72fa19580 call 7ff72fa5f8f0 call 7ff72fa588f0 call 7ff72fba7d20 call 7ff72f9f9140 * 2 call 7ff72f9d3be0 3552->3610 3643 7ff72fba067f-7ff72fba0766 call 7ff72f9d0e90 call 7ff72fa19580 call 7ff72fa5f8f0 call 7ff72fa588f0 call 7ff72fba7d20 call 7ff72f9f9140 * 2 call 7ff72f9d3be0 3609->3643 3644 7ff72fba0767-7ff72fba07b2 call 7ff72f9e2900 call 7ff72f9e2950 3609->3644 3610->3609 3643->3644 3656 7ff72fba0a73-7ff72fba0a82 call 7ff72f9ff380 3644->3656 3657 7ff72fba07b8-7ff72fba08a8 call 7ff72f9d0e90 call 7ff72fa19580 call 7ff72fa5f8f0 call 7ff72fa588f0 call 7ff72fa4bf80 call 7ff72f9f9140 * 2 call 7ff72f9d3be0 3644->3657 3666 7ff72fba0a88-7ff72fba109b call 7ff72f9d11a0 call 7ff72fa198a0 call 7ff72f9d11a0 call 7ff72fa198a0 call 7ff72f9d11a0 call 7ff72fa198a0 call 7ff72f9d11a0 call 7ff72fa198a0 call 7ff72f9ff420 call 7ff72f9fb5c0 call 7ff72fb9b4e0 call 7ff72fa33390 call 7ff72f9ff420 call 7ff72f9fb5c0 call 7ff72fb9b760 call 7ff72f9fb5c0 call 7ff72fb9b120 call 7ff72fba7e90 call 7ff72f9d05d0 call 7ff72f9d11a0 call 7ff72fa198a0 call 7ff72fb95480 call 7ff72f9fc650 call 7ff72f9e31e0 call 7ff72f9d04b0 call 7ff72f9d0450 call 7ff72fa18e90 call 7ff72f9cd210 call 7ff72f9da250 call 7ff72f9d3680 * 2 call 7ff72f9d3be0 call 7ff72f9d0450 call 7ff72fa18e90 call 7ff72f9d0450 call 7ff72fa18e90 call 7ff72f9d0450 call 7ff72fa18e90 call 7ff72f9d0450 call 7ff72fa18e90 call 7ff72fa5ca30 call 7ff72f9d3680 * 4 call 7ff72f9f91f0 call 7ff72f9d3680 * 6 3656->3666 3667 7ff72fba109c-7ff72fba1112 call 7ff72fb9c450 call 7ff72fb9c430 call 7ff72f9f9140 call 7ff72f9d3be0 * 5 3656->3667 3716 7ff72fba0a6e 3657->3716 3717 7ff72fba08ae-7ff72fba0963 call 7ff72f9d0e90 call 7ff72fa19580 call 7ff72fa5f8f0 call 7ff72fa588f0 call 7ff72fba7270 3657->3717 3666->3667 3716->3656 3739 7ff72fba0968-7ff72fba0a6d call 7ff72f9f9140 * 2 call 7ff72f9d3be0 call 7ff72f9ff420 call 7ff72f9fb5c0 call 7ff72f9ff420 call 7ff72fb9b360 call 7ff72fb9c430 3717->3739 3739->3716
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72F9D0F30: char_traits.LIBCPMTD ref: 00007FF72F9D0F5D
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA19AA0: type_info::_name_internal_method.LIBCMTD ref: 00007FF72FA19B51
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA19AA0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72FA19B8C
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA19AA0: shared_ptr.LIBCMTD ref: 00007FF72FA19BC8
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72F9D0E90: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72F9D0EAD
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA19580: shared_ptr.LIBCMTD ref: 00007FF72FA195B3
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA19580: shared_ptr.LIBCMTD ref: 00007FF72FA1963C
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA588F0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72FA58930
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA588F0: std::_Is_slash_oper::operator.LIBCPMTD ref: 00007FF72FA58982
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA588F0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72FA589B2
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA588F0: std::_Is_slash_oper::operator.LIBCPMTD ref: 00007FF72FA58A27
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FBA7830: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72FBA7944
                                                                                                                                                                                                                                            • Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FF72FBA0779
                                                                                                                                                                                                                                            • HandleT.LIBCPMTD ref: 00007FF72FBA0788
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Concurrency::details::EmptyQueue::StructuredWork$shared_ptr$Is_slash_oper::operatorstd::_$Concurrency::details::_CriticalHandleLock::_ReentrantScoped_lockScoped_lock::~_char_traitstype_info::_name_internal_method
                                                                                                                                                                                                                                            • String ID: /p.gif$Default$Extensions$Guest Profile$Microsoft\Edge\User Data$Secure Preferences$data=%ws$ev.pcapp.store$ext_edge$pcdetails
                                                                                                                                                                                                                                            • API String ID: 9541410-4110900778
                                                                                                                                                                                                                                            • Opcode ID: c736709fc9d64de854f54d40dea7b2b4340236e0151b56441fd120d0fa236c46
                                                                                                                                                                                                                                            • Instruction ID: 08987507a2c259f83f600d527197bcc6e4f1e862ab56da89936125d522c647c6
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: c736709fc9d64de854f54d40dea7b2b4340236e0151b56441fd120d0fa236c46
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: E782C53260EAC695DAB0AB15E8912EFA364FBC5740F805132D6CD83B6AEE2CD545CF50
                                                                                                                                                                                                                                            Function 00007FF72FB9F160 Relevance: 23.4, APIs: 3, Strings: 10, Instructions: 661COMMON
                                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                                            control_flow_graph 3836 7ff72fb9f160-7ff72fb9f4c2 call 7ff72f9d0f30 call 7ff72fa19aa0 call 7ff72f9d0f30 call 7ff72fa19aa0 call 7ff72f9d0f30 call 7ff72fa19aa0 call 7ff72f9d0f30 call 7ff72fa19aa0 call 7ff72f9d0f30 call 7ff72fa19aa0 call 7ff72f9d0e90 call 7ff72fa19580 call 7ff72fa5f8f0 call 7ff72fb9caf0 call 7ff72fa588f0 call 7ff72f9f9140 * 2 call 7ff72f9d3be0 call 7ff72f9d1680 call 7ff72fba7830 call 7ff72f9d0e90 call 7ff72fa19580 call 7ff72fa5f8f0 call 7ff72fa588f0 call 7ff72fa4bf80 call 7ff72f9f9140 * 2 call 7ff72f9d3be0 3893 7ff72fb9f5b0-7ff72fb9f699 call 7ff72f9d0e90 call 7ff72fa19580 call 7ff72fa5f8f0 call 7ff72fa588f0 call 7ff72fa4bf80 call 7ff72f9f9140 * 2 call 7ff72f9d3be0 3836->3893 3894 7ff72fb9f4c8-7ff72fb9f5af call 7ff72f9d0e90 call 7ff72fa19580 call 7ff72fa5f8f0 call 7ff72fa588f0 call 7ff72fba7d20 call 7ff72f9f9140 * 2 call 7ff72f9d3be0 3836->3894 3927 7ff72fb9f69f-7ff72fb9f786 call 7ff72f9d0e90 call 7ff72fa19580 call 7ff72fa5f8f0 call 7ff72fa588f0 call 7ff72fba7d20 call 7ff72f9f9140 * 2 call 7ff72f9d3be0 3893->3927 3928 7ff72fb9f787-7ff72fb9f7d2 call 7ff72f9e2900 call 7ff72f9e2950 3893->3928 3894->3893 3927->3928 3940 7ff72fb9fa93-7ff72fb9faa2 call 7ff72f9ff380 3928->3940 3941 7ff72fb9f7d8-7ff72fb9f8c8 call 7ff72f9d0e90 call 7ff72fa19580 call 7ff72fa5f8f0 call 7ff72fa588f0 call 7ff72fa4bf80 call 7ff72f9f9140 * 2 call 7ff72f9d3be0 3928->3941 3950 7ff72fb9faa8-7ff72fba00bb call 7ff72f9d11a0 call 7ff72fa198a0 call 7ff72f9d11a0 call 7ff72fa198a0 call 7ff72f9d11a0 call 7ff72fa198a0 call 7ff72f9d11a0 call 7ff72fa198a0 call 7ff72f9ff420 call 7ff72f9fb5c0 call 7ff72fb9b4e0 call 7ff72fa33390 call 7ff72f9ff420 call 7ff72f9fb5c0 call 7ff72fb9b760 call 7ff72f9fb5c0 call 7ff72fb9b120 call 7ff72fba7e90 call 7ff72f9d05d0 call 7ff72f9d11a0 call 7ff72fa198a0 call 7ff72fb95480 call 7ff72f9fc650 call 7ff72f9e31e0 call 7ff72f9d04b0 call 7ff72f9d0450 call 7ff72fa18e90 call 7ff72f9cd210 call 7ff72f9da250 call 7ff72f9d3680 * 2 call 7ff72f9d3be0 call 7ff72f9d0450 call 7ff72fa18e90 call 7ff72f9d0450 call 7ff72fa18e90 call 7ff72f9d0450 call 7ff72fa18e90 call 7ff72f9d0450 call 7ff72fa18e90 call 7ff72fa5ca30 call 7ff72f9d3680 * 4 call 7ff72f9f91f0 call 7ff72f9d3680 * 6 3940->3950 3951 7ff72fba00bc-7ff72fba0132 call 7ff72fb9c450 call 7ff72fb9c430 call 7ff72f9f9140 call 7ff72f9d3be0 * 5 3940->3951 4000 7ff72fb9fa8e 3941->4000 4001 7ff72fb9f8ce-7ff72fb9f983 call 7ff72f9d0e90 call 7ff72fa19580 call 7ff72fa5f8f0 call 7ff72fa588f0 call 7ff72fba7270 3941->4001 3950->3951 4000->3940 4023 7ff72fb9f988-7ff72fb9fa8d call 7ff72f9f9140 * 2 call 7ff72f9d3be0 call 7ff72f9ff420 call 7ff72f9fb5c0 call 7ff72f9ff420 call 7ff72fb9b360 call 7ff72fb9c430 4001->4023 4023->4000
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72F9D0F30: char_traits.LIBCPMTD ref: 00007FF72F9D0F5D
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA19AA0: type_info::_name_internal_method.LIBCMTD ref: 00007FF72FA19B51
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA19AA0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72FA19B8C
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA19AA0: shared_ptr.LIBCMTD ref: 00007FF72FA19BC8
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72F9D0E90: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72F9D0EAD
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA19580: shared_ptr.LIBCMTD ref: 00007FF72FA195B3
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA19580: shared_ptr.LIBCMTD ref: 00007FF72FA1963C
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA588F0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72FA58930
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA588F0: std::_Is_slash_oper::operator.LIBCPMTD ref: 00007FF72FA58982
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA588F0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72FA589B2
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA588F0: std::_Is_slash_oper::operator.LIBCPMTD ref: 00007FF72FA58A27
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FBA7830: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72FBA7944
                                                                                                                                                                                                                                            • Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FF72FB9F799
                                                                                                                                                                                                                                            • HandleT.LIBCPMTD ref: 00007FF72FB9F7A8
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Concurrency::details::EmptyQueue::StructuredWork$shared_ptr$Is_slash_oper::operatorstd::_$Concurrency::details::_CriticalHandleLock::_ReentrantScoped_lockScoped_lock::~_char_traitstype_info::_name_internal_method
                                                                                                                                                                                                                                            • String ID: /p.gif$Default$Extensions$Google\Chrome\User Data$Guest Profile$Secure Preferences$data=%ws$ev.pcapp.store$ext_chrome$pcdetails
                                                                                                                                                                                                                                            • API String ID: 9541410-2486191938
                                                                                                                                                                                                                                            • Opcode ID: ba9d4b3e672817db971ea13273cff04dcfc0b57a0d6590367b2741108e5f623f
                                                                                                                                                                                                                                            • Instruction ID: c0e84aba088780a0f606285057422c6eb513e2ab04e4545b63484d65100bd1fa
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: ba9d4b3e672817db971ea13273cff04dcfc0b57a0d6590367b2741108e5f623f
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 0D82C43260EAC695DAB0AB15E8912EFA364FBC5740F805132D6CD83B6EEE2CD545CF50
                                                                                                                                                                                                                                            Function 00007FF72FA1BE70 Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 264timeCOMMON
                                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                                            control_flow_graph 4120 7ff72fa1be70-7ff72fa1beab 4121 7ff72fa1bf50-7ff72fa1bf52 4120->4121 4122 7ff72fa1beb1-7ff72fa1beca call 7ff72fa06b60 4120->4122 4123 7ff72fa1c4c9-7ff72fa1c4d0 4121->4123 4126 7ff72fa1becc-7ff72fa1bedf 4122->4126 4127 7ff72fa1bee1-7ff72fa1beed 4122->4127 4128 7ff72fa1bef2-7ff72fa1bf5d call 7ff72f9cd210 WinHttpConnect 4126->4128 4127->4128 4132 7ff72fa1c449-7ff72fa1c44b 4128->4132 4133 7ff72fa1bf63-7ff72fa1c2bb call 7ff72f9d05d0 GetTickCount64 call 7ff72fa06b60 4128->4133 4132->4123 4138 7ff72fa1c2dd-7ff72fa1c2f1 call 7ff72f9cd210 4133->4138 4139 7ff72fa1c2bd-7ff72fa1c2db call 7ff72f9cd210 4133->4139 4144 7ff72fa1c2f9-7ff72fa1c3cf call 7ff72f9cd210 call 7ff72f9da250 call 7ff72f9cd210 WinHttpOpenRequest 4138->4144 4139->4144 4151 7ff72fa1c43c-7ff72fa1c453 call 7ff72f9d3680 4144->4151 4152 7ff72fa1c3d1-7ff72fa1c3f7 WinHttpSetTimeouts 4144->4152 4161 7ff72fa1c485-7ff72fa1c48a 4151->4161 4162 7ff72fa1c455-7ff72fa1c481 WinHttpSendRequest 4151->4162 4152->4151 4154 7ff72fa1c3f9-7ff72fa1c3ff 4152->4154 4156 7ff72fa1c40d-7ff72fa1c413 4154->4156 4157 7ff72fa1c401-7ff72fa1c40c WinHttpCloseHandle 4154->4157 4159 7ff72fa1c421-7ff72fa1c437 call 7ff72f9d3680 4156->4159 4160 7ff72fa1c415-7ff72fa1c420 WinHttpCloseHandle 4156->4160 4157->4156 4159->4123 4160->4159 4165 7ff72fa1c48c-7ff72fa1c499 WinHttpReceiveResponse 4161->4165 4166 7ff72fa1c49d-7ff72fa1c4a3 4161->4166 4162->4161 4165->4166 4167 7ff72fa1c4b1-7ff72fa1c4b7 4166->4167 4168 7ff72fa1c4a5-7ff72fa1c4b0 WinHttpCloseHandle 4166->4168 4169 7ff72fa1c4b9-7ff72fa1c4c4 WinHttpCloseHandle 4167->4169 4170 7ff72fa1c4c5 4167->4170 4168->4167 4169->4170 4170->4123
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Http$CloseHandle$Requeststd::ios_base::good$ConnectCount64OpenReceiveResponseSendTickTimeouts
                                                                                                                                                                                                                                            • String ID: GET
                                                                                                                                                                                                                                            • API String ID: 2571818228-1805413626
                                                                                                                                                                                                                                            • Opcode ID: 97b424a5f142e7ff86e6a48141ea42eb383f2602b031ef10f70d93426b751497
                                                                                                                                                                                                                                            • Instruction ID: c1b4d42eeb23990179fc118f19a2a45b5f1b8d5b2b8599cbd15b663283208e50
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 97b424a5f142e7ff86e6a48141ea42eb383f2602b031ef10f70d93426b751497
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: B3F16E36609FC585DAB09B5AF8843DAB3A4F789B94F504126DACD83B68DF7CD094CB10
                                                                                                                                                                                                                                            Function 00007FF72F9DE340 Relevance: 19.6, APIs: 5, Strings: 6, Instructions: 302windowCOMMON
                                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                                            control_flow_graph 4171 7ff72f9de340-7ff72f9de36a 4172 7ff72f9de395-7ff72f9de39d 4171->4172 4173 7ff72f9de36c-7ff72f9de371 4171->4173 4176 7ff72f9de3a3-7ff72f9de3ab 4172->4176 4177 7ff72f9de425-7ff72f9de42e 4172->4177 4174 7ff72f9de420 4173->4174 4175 7ff72f9de377-7ff72f9de37c 4173->4175 4178 7ff72f9de9ec-7ff72f9dea0b DefWindowProcW 4174->4178 4181 7ff72f9de3b6 4175->4181 4182 7ff72f9de37e-7ff72f9de383 4175->4182 4183 7ff72f9de3b1 4176->4183 4184 7ff72f9de99b-7ff72f9de9a4 4176->4184 4179 7ff72f9de434-7ff72f9de6d8 call 7ff72f9d11a0 call 7ff72fa198a0 call 7ff72f9d11a0 call 7ff72fa198a0 call 7ff72f9d11a0 call 7ff72fa198a0 call 7ff72f9d0510 * 2 call 7ff72f9d0450 call 7ff72fa18e90 call 7ff72f9d0450 call 7ff72fa18e90 call 7ff72f9d0450 call 7ff72fa18e90 call 7ff72fa5d350 call 7ff72f9d3680 * 8 4177->4179 4180 7ff72f9de6dd-7ff72f9de6e6 4177->4180 4185 7ff72f9dea11-7ff72f9dea18 4178->4185 4187 7ff72f9de999 4179->4187 4186 7ff72f9de6ec-7ff72f9de998 call 7ff72f9d11a0 call 7ff72fa198a0 call 7ff72f9d11a0 call 7ff72fa198a0 call 7ff72f9d11a0 call 7ff72fa198a0 call 7ff72f9d0510 * 2 call 7ff72f9d0450 call 7ff72fa18e90 call 7ff72f9d0450 call 7ff72fa18e90 call 7ff72f9d0450 call 7ff72fa18e90 call 7ff72fa5d350 call 7ff72f9d3680 * 8 4180->4186 4180->4187 4181->4178 4191 7ff72f9de9ba-7ff72f9de9c3 PostQuitMessage 4182->4191 4192 7ff72f9de389-7ff72f9de38e 4182->4192 4193 7ff72f9de9c5-7ff72f9de9ea DefWindowProcW 4183->4193 4189 7ff72f9de9a6-7ff72f9de9af 4184->4189 4190 7ff72f9de9b8 4184->4190 4186->4187 4187->4178 4189->4190 4196 7ff72f9de9b1 4189->4196 4190->4178 4191->4178 4197 7ff72f9de390 4192->4197 4198 7ff72f9de3bb-7ff72f9de3d1 4192->4198 4193->4178 4193->4185 4196->4190 4197->4193 4199 7ff72f9de3d3-7ff72f9de3ed PostMessageW 4198->4199 4200 7ff72f9de3ef-7ff72f9de3f8 4198->4200 4203 7ff72f9de414-7ff72f9de416 4199->4203 4200->4203 4204 7ff72f9de3fa-7ff72f9de413 PostMessageW 4200->4204 4203->4185 4204->4203
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: MessagePostProcWindow$Quit
                                                                                                                                                                                                                                            • String ID: msg=resume_suspend$msg=suspend$product$product$system_event$system_event
                                                                                                                                                                                                                                            • API String ID: 3552470998-2520652036
                                                                                                                                                                                                                                            • Opcode ID: 1c1041d75c1aab2755773ee3b5e99be958956df5b19c79a6f52309ed99a875cd
                                                                                                                                                                                                                                            • Instruction ID: d34f7fde80c837f11a11c9ef5f6d9dfa9f3da726c62e183b318c6a0476f151b0
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 1c1041d75c1aab2755773ee3b5e99be958956df5b19c79a6f52309ed99a875cd
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: DFF1D632A0DAC691EA70BB14E8856EAB364FBC9744F901136D6CD82BADDF2CD544CF10
                                                                                                                                                                                                                                            Function 00007FF72F9D97D0 Relevance: 17.9, APIs: 5, Strings: 5, Instructions: 439COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: ChildEnumWindows$Concurrency::details::EmptyQueue::StructuredWork$Char_traitsClassNameTextWindowshared_ptrtype_info::_name_internal_method
                                                                                                                                                                                                                                            • String ID: =====> %ws FOUND <=====$Shell_TrayWnd$Start$TrayButton$TrayDummySearchControl
                                                                                                                                                                                                                                            • API String ID: 1535316472-2840285642
                                                                                                                                                                                                                                            • Opcode ID: 70d8ad68144b48b2f9c01f7626242af85469306aa3589a52b77e53d4ff1274b0
                                                                                                                                                                                                                                            • Instruction ID: 9bb396929f145c19f9a6e292adffcff3fafb773c5b409965d2f963289f611d68
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 70d8ad68144b48b2f9c01f7626242af85469306aa3589a52b77e53d4ff1274b0
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: CF32D53260DAC295E670BB15E8557EAF3A4EBC9740F900136D6CD82AAEDF2CD584CF50
                                                                                                                                                                                                                                            Function 00007FF72F9EA0D0 Relevance: 17.8, APIs: 4, Strings: 6, Instructions: 273COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72F9E62C0: RegOpenKeyExW.KERNEL32 ref: 00007FF72F9E643E
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72F9E62C0: RegQueryValueExW.KERNEL32 ref: 00007FF72F9E64F7
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72F9D11A0: _WChar_traits.LIBCPMTD ref: 00007FF72F9D11CD
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA198A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF72FA19930
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA198A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72FA1995D
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA198A0: shared_ptr.LIBCMTD ref: 00007FF72FA19993
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA198A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72FA19A2E
                                                                                                                                                                                                                                            • UnDecorator::getVbTableType.LIBCMTD ref: 00007FF72F9EA211
                                                                                                                                                                                                                                            • UnDecorator::getVbTableType.LIBCMTD ref: 00007FF72F9EA290
                                                                                                                                                                                                                                            • UnDecorator::getVbTableType.LIBCMTD ref: 00007FF72F9EA41F
                                                                                                                                                                                                                                            • UnDecorator::getVbTableType.LIBCMTD ref: 00007FF72F9EA31A
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA18E90: shared_ptr.LIBCMTD ref: 00007FF72FA18F05
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA18E90: shared_ptr.LIBCMTD ref: 00007FF72FA18F8E
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Decorator::getTableType$shared_ptr$Concurrency::details::EmptyQueue::StructuredWork$Char_traitsOpenQueryValuetype_info::_name_internal_method
                                                                                                                                                                                                                                            • String ID: RESTART$RUNNING$Unknown+state=%d$close_state=%ws$invalid_app_close$product
                                                                                                                                                                                                                                            • API String ID: 3445494136-3736349495
                                                                                                                                                                                                                                            • Opcode ID: 0ef8c8c61ddbf0aad11a03923681ca07593223f411238eaa978797f577a52fd7
                                                                                                                                                                                                                                            • Instruction ID: 0259f1dbabe8fec966208823a564053a743f8edc7bd68eea07a8518d0f15bf85
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 0ef8c8c61ddbf0aad11a03923681ca07593223f411238eaa978797f577a52fd7
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 4EE1D53260DAC195EA70AB14E8952EFB364FBC9340F905136D6CD82BAEDE2CD545CF10
                                                                                                                                                                                                                                            Function 00007FF72FA8B680 Relevance: 16.0, APIs: 3, Strings: 6, Instructions: 270comCOMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72F9D11A0: _WChar_traits.LIBCPMTD ref: 00007FF72F9D11CD
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72F9EB220: _Subatomic.LIBCONCRTD ref: 00007FF72F9EB28E
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA198A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF72FA19930
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA198A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72FA1995D
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA198A0: shared_ptr.LIBCMTD ref: 00007FF72FA19993
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA198A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72FA19A2E
                                                                                                                                                                                                                                            • CoInitialize.OLE32 ref: 00007FF72FA8BBAC
                                                                                                                                                                                                                                            • CoCreateInstance.OLE32 ref: 00007FF72FA8BBDD
                                                                                                                                                                                                                                            • shared_ptr.LIBCMTD ref: 00007FF72FA8BC13
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA18E90: shared_ptr.LIBCMTD ref: 00007FF72FA18F05
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA18E90: shared_ptr.LIBCMTD ref: 00007FF72FA18F8E
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA18E90: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72FA19190
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA8E0E0: Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FF72FA8E15B
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA8E0E0: HandleT.LIBCPMTD ref: 00007FF72FA8E16A
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: shared_ptr$Concurrency::details::EmptyQueue::StructuredWork$Char_traitsConcurrency::details::_CreateCriticalHandleInitializeInstanceLock::_ReentrantScoped_lockScoped_lock::~_Subatomictype_info::_name_internal_method
                                                                                                                                                                                                                                            • String ID: SearchApp.exe$SearchHost.exe$SearchUI.exe$ShellExperienceHost.exe$StartMenuExperienceHost.exe$explorer.exe
                                                                                                                                                                                                                                            • API String ID: 1408288539-3335880049
                                                                                                                                                                                                                                            • Opcode ID: 792032e3aeead8cd268500154b97704a2ac5dc2c12fceab4a21f83930b0f9473
                                                                                                                                                                                                                                            • Instruction ID: 6aed843edc0934b7bfa7d7210c86e9f2b3a40dc75dd1d15f63cc8df4b95a5500
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 792032e3aeead8cd268500154b97704a2ac5dc2c12fceab4a21f83930b0f9473
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 4DE1E736609AC591EAB0EB15E8943EAB760FBC9780F804136D68D43B69EF3CD544CF50
                                                                                                                                                                                                                                            Function 00007FF72FB7CD30 Relevance: 16.0, APIs: 3, Strings: 6, Instructions: 242comCOMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72F9D11A0: _WChar_traits.LIBCPMTD ref: 00007FF72F9D11CD
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA198A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF72FA19930
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA198A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72FA1995D
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA198A0: shared_ptr.LIBCMTD ref: 00007FF72FA19993
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA198A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72FA19A2E
                                                                                                                                                                                                                                            • CoCreateInstance.COMBASE ref: 00007FF72FB7D0B8
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FB79560: SetLastError.KERNEL32 ref: 00007FF72FB79570
                                                                                                                                                                                                                                            • GetLastError.KERNEL32 ref: 00007FF72FB7D0D2
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72F9D10B0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72F9D10CD
                                                                                                                                                                                                                                            • Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 00007FF72FB7D1C1
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Concurrency::details::EmptyQueue::StructuredWork$ErrorLast$Char_traitsConcurrency::details::_CreateInstanceSchedulerScheduler::_shared_ptrtype_info::_name_internal_method
                                                                                                                                                                                                                                            • String ID: CoCreateInstance+CLSID_AppVisibility+IID_IAppVisibility$CoInitialize+Init+Failed${"app" : {"hide_window": "menu_search"}}${"app" : {"hide_window": "menu_store"}}${"app" : {"menu_store" : {"top":%d,"left":%d,"bottom":%d,"right":%d}}}${"app" : {"show_window": "menu_store","menu_store" : {"top":%d,"left":%d,"bottom":%d,"right":%d}}}
                                                                                                                                                                                                                                            • API String ID: 2502378382-2706694235
                                                                                                                                                                                                                                            • Opcode ID: 3bf878e510be2b90916a63a3b7fbdf19a39ff619ee5bc5c44cf0c764c9c56cc4
                                                                                                                                                                                                                                            • Instruction ID: 74ece897b05bbfa1e83be83bb6938a9c2ed261ba4ab73ca0cfe783e02713b325
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 3bf878e510be2b90916a63a3b7fbdf19a39ff619ee5bc5c44cf0c764c9c56cc4
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: F3D1D832619AC291EA71AB14E8913EBB364FBC9780F904136D6CD83BA9DF2CD545CF50
                                                                                                                                                                                                                                            Function 00007FF72FA809E0 Relevance: 14.6, APIs: 3, Strings: 5, Instructions: 649commemoryCOMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • SysAllocString.OLEAUT32 ref: 00007FF72FA80ADA
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72F9D11A0: _WChar_traits.LIBCPMTD ref: 00007FF72F9D11CD
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA198A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF72FA19930
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA198A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72FA1995D
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA198A0: shared_ptr.LIBCMTD ref: 00007FF72FA19993
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA198A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72FA19A2E
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72F9D10B0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72F9D10CD
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72F9D5040: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72F9D506B
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72F9D5040: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72F9D507A
                                                                                                                                                                                                                                            • CoInitializeEx.OLE32 ref: 00007FF72FA81882
                                                                                                                                                                                                                                            • CoCreateInstance.OLE32 ref: 00007FF72FA818B3
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72F9EB220: _Subatomic.LIBCONCRTD ref: 00007FF72F9EB28E
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Concurrency::details::EmptyQueue::StructuredWork$AllocChar_traitsCreateInitializeInstanceStringSubatomicshared_ptrtype_info::_name_internal_method
                                                                                                                                                                                                                                            • String ID: ask.com/web$bing.com/search$duckduckgo.com/$google.com/search$yahoo.com/search
                                                                                                                                                                                                                                            • API String ID: 214599529-3118188808
                                                                                                                                                                                                                                            • Opcode ID: 1390d1198a6acadbf0cbebc1cd0eeadf8e8b54788959b961882cf44d1360c3f0
                                                                                                                                                                                                                                            • Instruction ID: d82c312934338e54970ba6ad3a3aa0e583acfa2cbd75e05207868a7588bfe12c
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 1390d1198a6acadbf0cbebc1cd0eeadf8e8b54788959b961882cf44d1360c3f0
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 8672D332609EC191EA70AB15E8953EBB364FBC9780F805136D6CD83B6AEE2CD554CF50
                                                                                                                                                                                                                                            Function 00007FF72FBA7270 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 245COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FB95DD0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72FB95DED
                                                                                                                                                                                                                                            • Concurrency::details::VirtualProcessorRoot::GetSchedulerProxy.LIBCMTD ref: 00007FF72FBA72E0
                                                                                                                                                                                                                                            • std::runtime_error::runtime_error.LIBCPMTD ref: 00007FF72FBA737F
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72F9D3480: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72F9D3493
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FBE3DA0: RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF72F9E227F), ref: 00007FF72FBE3DF0
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FBE3DA0: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF72F9E227F), ref: 00007FF72FBE3E31
                                                                                                                                                                                                                                            • Concurrency::details::VirtualProcessorRoot::GetSchedulerProxy.LIBCMTD ref: 00007FF72FBA73E5
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72F9D0F30: char_traits.LIBCPMTD ref: 00007FF72F9D0F5D
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA19AA0: type_info::_name_internal_method.LIBCMTD ref: 00007FF72FA19B51
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA19AA0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72FA19B8C
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA19AA0: shared_ptr.LIBCMTD ref: 00007FF72FA19BC8
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72F9D0E90: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72F9D0EAD
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA19580: shared_ptr.LIBCMTD ref: 00007FF72FA195B3
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA19580: shared_ptr.LIBCMTD ref: 00007FF72FA1963C
                                                                                                                                                                                                                                            • allocator.LIBCPMTD ref: 00007FF72FBA7667
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA588C0: Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 00007FF72FA588D8
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FB9C630: Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 00007FF72FB9C655
                                                                                                                                                                                                                                            • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72FBA7733
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Concurrency::details::$EmptyQueue::StructuredWork$Schedulershared_ptr$ProcessorProxyRoot::Virtual$Affinity::operator!=Concurrency::details::_ExceptionFileHardwareHeaderRaiseScheduler::_allocatorchar_traitsstd::runtime_error::runtime_errortype_info::_name_internal_method
                                                                                                                                                                                                                                            • String ID: Could not open file for reading$extensions$settings
                                                                                                                                                                                                                                            • API String ID: 486076642-1363464879
                                                                                                                                                                                                                                            • Opcode ID: b7fd6b3322642d816b90a903ba759ea850b8848c6eb4e58592ada5f3734fffeb
                                                                                                                                                                                                                                            • Instruction ID: e3ebdc5d8331794b815206f737899ea7f636ad31e9916e3024cec43f579be32e
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: b7fd6b3322642d816b90a903ba759ea850b8848c6eb4e58592ada5f3734fffeb
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: C1D1D63261EAC195DA70AB15E8903EFB364FBC5340F905132D6CD82A6AEF2CD545CF50
                                                                                                                                                                                                                                            Function 00007FF72F9D16D0 Relevance: 13.1, APIs: 4, Strings: 3, Instructions: 827COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72F9D11A0: _WChar_traits.LIBCPMTD ref: 00007FF72F9D11CD
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FB7E070: CoInitializeEx.COMBASE ref: 00007FF72FB7E0E0
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72F9F8980: Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 00007FF72F9F899A
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72F9D1540: _Ptr_base.LIBCMTD ref: 00007FF72F9D154E
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA198A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF72FA19930
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA198A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72FA1995D
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA198A0: shared_ptr.LIBCMTD ref: 00007FF72FA19993
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA198A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72FA19A2E
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72F9D10B0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72F9D10CD
                                                                                                                                                                                                                                            • CreateEventW.KERNEL32 ref: 00007FF72F9D1C48
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72F9D97A0: GetDesktopWindow.USER32 ref: 00007FF72F9D97A9
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72F9D97A0: EnumChildWindows.USER32 ref: 00007FF72F9D97BC
                                                                                                                                                                                                                                            • CreateDirectoryW.KERNEL32 ref: 00007FF72F9D1DEF
                                                                                                                                                                                                                                            • CreateEventW.KERNEL32 ref: 00007FF72F9D1EEC
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA6C0B0: OpenEventW.KERNEL32 ref: 00007FF72FA6C1D6
                                                                                                                                                                                                                                            • UnDecorator::getVbTableType.LIBCMTD ref: 00007FF72F9D1F52
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FBE2BD0: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF72FBE2C00
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FBE2BD0: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF72FBE2C06
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Concurrency::details::CreateEmptyEventQueue::StructuredWork$Concurrency::cancel_current_task$Char_traitsChildConcurrency::details::_Decorator::getDesktopDirectoryEnumInitializeOpenPtr_baseSchedulerScheduler::_TableTypeWindowWindowsshared_ptrtype_info::_name_internal_method
                                                                                                                                                                                                                                            • String ID: ClosingEvent$DEBUGSCREEN_EVENT$\download
                                                                                                                                                                                                                                            • API String ID: 3598548489-3079862309
                                                                                                                                                                                                                                            • Opcode ID: 5133ec6fcc5e27f59838f270070bbc01fe5bf86371af595254908f054913e3ed
                                                                                                                                                                                                                                            • Instruction ID: 03d6e703e9ee9514cadd320f391c3da5860584b19bce7f6f97715b3f810b022b
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 5133ec6fcc5e27f59838f270070bbc01fe5bf86371af595254908f054913e3ed
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 75A2D732609FC581EA70AB19E8953EBA364FB85781F405536DACD87B9AEF3CC1448F50
                                                                                                                                                                                                                                            Function 00007FF72FA46000 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 178COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72F9D11A0: _WChar_traits.LIBCPMTD ref: 00007FF72F9D11CD
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA198A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF72FA19930
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA198A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72FA1995D
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA198A0: shared_ptr.LIBCMTD ref: 00007FF72FA19993
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA198A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72FA19A2E
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA18E90: shared_ptr.LIBCMTD ref: 00007FF72FA18F05
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA18E90: shared_ptr.LIBCMTD ref: 00007FF72FA18F8E
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA18E90: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72FA19190
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA52420: RegCreateKeyW.ADVAPI32 ref: 00007FF72FA52470
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA52420: strrchr.LIBCMTD ref: 00007FF72FA52487
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA52420: RegQueryValueExW.KERNEL32 ref: 00007FF72FA524D3
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA52420: RegCloseKey.KERNEL32 ref: 00007FF72FA524ED
                                                                                                                                                                                                                                            • UnDecorator::getVbTableType.LIBCMTD ref: 00007FF72FA4620E
                                                                                                                                                                                                                                            • std::ios_base::good.LIBCPMTD ref: 00007FF72FA4622A
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA52310: RegCreateKeyW.ADVAPI32 ref: 00007FF72FA52347
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA52310: RegQueryValueExW.KERNEL32 ref: 00007FF72FA52392
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA52310: RegCloseKey.ADVAPI32 ref: 00007FF72FA523A1
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Concurrency::details::EmptyQueue::StructuredWorkshared_ptr$CloseCreateQueryValue$Char_traitsDecorator::getTableTypestd::ios_base::goodstrrchrtype_info::_name_internal_method
                                                                                                                                                                                                                                            • String ID: %lu$BuildNumber$CurrentBuild$SOFTWARE\Microsoft\Windows NT\CurrentVersion$SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
                                                                                                                                                                                                                                            • API String ID: 1851878312-1501554625
                                                                                                                                                                                                                                            • Opcode ID: a9b403ab3ca56307dce8ec0c3d58a9cf7f0ce06026955f7a7ce02eebe037972e
                                                                                                                                                                                                                                            • Instruction ID: ad35b6ba6aa088a3e78175787134184437b0df6091228896aaff5f6ab93ab683
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: a9b403ab3ca56307dce8ec0c3d58a9cf7f0ce06026955f7a7ce02eebe037972e
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 70A1E532609AC190EA70AB15E8917EBB3A4FBC9744F905136E6CD82BADDF2CD544CF10
                                                                                                                                                                                                                                            Function 00007FF72F9ED500 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 102registryCOMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72F9D11A0: _WChar_traits.LIBCPMTD ref: 00007FF72F9D11CD
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA198A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF72FA19930
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA198A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72FA1995D
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA198A0: shared_ptr.LIBCMTD ref: 00007FF72FA19993
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA198A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72FA19A2E
                                                                                                                                                                                                                                            • GetModuleFileNameW.KERNEL32 ref: 00007FF72F9ED606
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72F9D10B0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72F9D10CD
                                                                                                                                                                                                                                            • RegOpenKeyExW.KERNEL32 ref: 00007FF72F9ED681
                                                                                                                                                                                                                                            • RegSetValueExW.KERNEL32 ref: 00007FF72F9ED6DA
                                                                                                                                                                                                                                            • RegCloseKey.ADVAPI32 ref: 00007FF72F9ED6FE
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Concurrency::details::EmptyQueue::StructuredWork$Char_traitsCloseFileModuleNameOpenValueshared_ptrtype_info::_name_internal_method
                                                                                                                                                                                                                                            • String ID: PCAppStore$Software\PCAppStore$status
                                                                                                                                                                                                                                            • API String ID: 2919119571-3586994989
                                                                                                                                                                                                                                            • Opcode ID: 8e569da3ea7d066dd7bff6d20c3c9c96871b0619e91943290ed47e80dfd16652
                                                                                                                                                                                                                                            • Instruction ID: 22d700bd1e45f8728bbcf74a53b5155fe9a1970aa910fb5950def44d6393a091
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 8e569da3ea7d066dd7bff6d20c3c9c96871b0619e91943290ed47e80dfd16652
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 8051E872619AC196E660EB14E8807EAB364FBC9780F905136E6CD83B69DF3CD544CF50
                                                                                                                                                                                                                                            Function 00007FF72FA30E90 Relevance: 11.0, APIs: 1, Strings: 5, Instructions: 488COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Func_class
                                                                                                                                                                                                                                            • String ID: array$object$object key$object separator$value
                                                                                                                                                                                                                                            • API String ID: 1670654298-2448007618
                                                                                                                                                                                                                                            • Opcode ID: 7e87fd77274a521ca8a168015b1351c09e933640632d342c78326851afa799f0
                                                                                                                                                                                                                                            • Instruction ID: 587f1ccf943c3c0442facee109d872d4deee54ed811d1bfaa328a693d9402afa
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 7e87fd77274a521ca8a168015b1351c09e933640632d342c78326851afa799f0
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 5C42056660DBC585DAB0AB15E8906EEB3A4EBC5784F800136E6CD87B6ADF3CD540CF50
                                                                                                                                                                                                                                            Function 00007FF72FB7E460 Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 403COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72F9D11A0: _WChar_traits.LIBCPMTD ref: 00007FF72F9D11CD
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA198A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF72FA19930
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA198A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72FA1995D
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA198A0: shared_ptr.LIBCMTD ref: 00007FF72FA19993
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA198A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72FA19A2E
                                                                                                                                                                                                                                            • Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 00007FF72FB7E6D8
                                                                                                                                                                                                                                            • Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 00007FF72FB7E7AE
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Concurrency::details::$Affinity::operator!=EmptyHardwareQueue::StructuredWork$Char_traitsshared_ptrtype_info::_name_internal_method
                                                                                                                                                                                                                                            • String ID: Shell_TrayWnd$Taskbar
                                                                                                                                                                                                                                            • API String ID: 2730265358-1897506974
                                                                                                                                                                                                                                            • Opcode ID: 89ab665ff453f8a6bbf2b0ad49246ecaf5bb24773d356c50de1375d331f92ef6
                                                                                                                                                                                                                                            • Instruction ID: 8e12b81b376a649f8376f19bfeb4ea60d306b8aa22f28b7ebf9e5e97faa04dc6
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 89ab665ff453f8a6bbf2b0ad49246ecaf5bb24773d356c50de1375d331f92ef6
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 5222C736619AC595D660EB19E8916EEB3A0FBC9740F804132E6CD87BAADF3CD544CF10
                                                                                                                                                                                                                                            Function 00007FF72FC05434 Relevance: 10.8, APIs: 7, Instructions: 290COMMONLIBRARYCODE
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 3215553584-0
                                                                                                                                                                                                                                            • Opcode ID: 9b811db71ff22be1002fbdf382d72d3e59745099eacdcbb80f3bbc8dbd0974c3
                                                                                                                                                                                                                                            • Instruction ID: ffa76ea81a47d7bab47a69f83d87a9b40c24d8ddf468471dbeaaecb5e78f6882
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 9b811db71ff22be1002fbdf382d72d3e59745099eacdcbb80f3bbc8dbd0974c3
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 6BC1C732F0C7C693E7506B19A8506FDA765EB80B80FD54539EA4D03392DE7DE58A8F20
                                                                                                                                                                                                                                            Function 00007FF72FA52F10 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 32windowCOMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Message$MetricsSystem
                                                                                                                                                                                                                                            • String ID: 0
                                                                                                                                                                                                                                            • API String ID: 2388057244-4108050209
                                                                                                                                                                                                                                            • Opcode ID: cca869797438b31eb8facd3317cb589d6587005e4eef270a41aee582d9d839c9
                                                                                                                                                                                                                                            • Instruction ID: 84a3aa893fc08fe01d00f194599d2833b8f00e9cda0e14b964dbe35859754b86
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: cca869797438b31eb8facd3317cb589d6587005e4eef270a41aee582d9d839c9
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: BA014F726186848BE7249F24F95836AB7B1F788B44F805139E68E42798DF7DC148CF10
                                                                                                                                                                                                                                            Function 00007FF72F9FC170 Relevance: 9.3, APIs: 6, Instructions: 251COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Decorator::getTableTypebool_shared_ptr$Concurrency::details::EmptyQueue::StructuredWork
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 2631667939-0
                                                                                                                                                                                                                                            • Opcode ID: 8cd9c04e8c90d84e519dc32f51eb5543153d38e4056129efc2626c9af447e34a
                                                                                                                                                                                                                                            • Instruction ID: 2cd2f59174030e8bd2f869f68c29d6008b28591b912a96c8312d0484e0efc838
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 8cd9c04e8c90d84e519dc32f51eb5543153d38e4056129efc2626c9af447e34a
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: BDC1FD2271CAC690DB60EB15E8912EEE364EBC5784F805132E6CD877AEDE6CD544CF10
                                                                                                                                                                                                                                            Function 00007FF72FA7BBA0 Relevance: 9.2, APIs: 6, Instructions: 249COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                                                            • Opcode ID: 4cc3fc690caf46b215ce346ccdf43ddad07f5910bdaaf1cb7ebd7b0cc30fae4f
                                                                                                                                                                                                                                            • Instruction ID: e8dbb2352ef7c6e9f48ce79d2fd1c912c122656022577cb8c4c5bc69f31b0c87
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 4cc3fc690caf46b215ce346ccdf43ddad07f5910bdaaf1cb7ebd7b0cc30fae4f
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: D5C1077260DAC195EA60EB15E8407EEE3A0EBC5790F904136E68D83BA9DE6CD548CF10
                                                                                                                                                                                                                                            Function 00007FF72F9E62C0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 120registryCOMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72F9D11A0: _WChar_traits.LIBCPMTD ref: 00007FF72F9D11CD
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA198A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF72FA19930
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA198A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72FA1995D
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA198A0: shared_ptr.LIBCMTD ref: 00007FF72FA19993
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA198A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72FA19A2E
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72F9D10B0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72F9D10CD
                                                                                                                                                                                                                                            • RegOpenKeyExW.KERNEL32 ref: 00007FF72F9E643E
                                                                                                                                                                                                                                            • RegQueryValueExW.KERNEL32 ref: 00007FF72F9E64F7
                                                                                                                                                                                                                                            • RegCloseKey.ADVAPI32 ref: 00007FF72F9E6523
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Concurrency::details::EmptyQueue::StructuredWork$Char_traitsCloseOpenQueryValueshared_ptrtype_info::_name_internal_method
                                                                                                                                                                                                                                            • String ID: Software\PCAppStore$status
                                                                                                                                                                                                                                            • API String ID: 2952970082-3794422696
                                                                                                                                                                                                                                            • Opcode ID: a1a8b09ce90d6429a3231a6ded1379eae8a284057ffed0ec9dbca8af9883aed8
                                                                                                                                                                                                                                            • Instruction ID: 8f2cfe32c884db9c525c5ffd6cc369f6db9bc15402ec0ed3e1f457870f10f13e
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: a1a8b09ce90d6429a3231a6ded1379eae8a284057ffed0ec9dbca8af9883aed8
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: C661C332619AC195E660AB14E8917EBB3A4FBC8780F905136E6CD83B69DF3CD544CF50
                                                                                                                                                                                                                                            Function 00007FF72FA8AB80 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 110COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72F9D11A0: _WChar_traits.LIBCPMTD ref: 00007FF72F9D11CD
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA198A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF72FA19930
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA198A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72FA1995D
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA198A0: shared_ptr.LIBCMTD ref: 00007FF72FA19993
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA198A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72FA19A2E
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72F9D10B0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72F9D10CD
                                                                                                                                                                                                                                            • OpenEventW.KERNEL32 ref: 00007FF72FA8AC42
                                                                                                                                                                                                                                            • shared_ptr.LIBCMTD ref: 00007FF72FA8ACFD
                                                                                                                                                                                                                                            • Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 00007FF72FA8AD10
                                                                                                                                                                                                                                            • std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FF72FA8AD5E
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Concurrency::details::$EmptyQueue::StructuredWork$shared_ptr$Affinity::operator!=Char_traitsEventFac_nodeFac_node::_HardwareOpenstd::_type_info::_name_internal_method
                                                                                                                                                                                                                                            • String ID: DEBUGSCREEN_EVENT
                                                                                                                                                                                                                                            • API String ID: 4219698036-491765807
                                                                                                                                                                                                                                            • Opcode ID: 36fe88091eba3a1a88ac93a311ac646382b98fe355a7426f0759d71f5a5a663e
                                                                                                                                                                                                                                            • Instruction ID: b2e173b3f80fd1102fd491947b0802c14785095045f14fda3cbdb9b600b00098
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 36fe88091eba3a1a88ac93a311ac646382b98fe355a7426f0759d71f5a5a663e
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: C051093261DAC591EA20AB15E8813EBE360FBC5780F904036E6CD87B6ADE2CD545CF50
                                                                                                                                                                                                                                            Function 00007FF72FBEFC38 Relevance: 7.6, APIs: 5, Instructions: 60threadCOMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: CloseCreateErrorFreeHandleLastLibraryThread_invalid_parameter_noinfo
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 2067211477-0
                                                                                                                                                                                                                                            • Opcode ID: 98fd7ff7b0ded043c1c8bd62d9dc79a70e5c77a2b738dab7989ce3feaa60c173
                                                                                                                                                                                                                                            • Instruction ID: b8076e33aa47ae5c4f1f4120adcb139bf7675bc8678e0596e89dc671b2d394c1
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 98fd7ff7b0ded043c1c8bd62d9dc79a70e5c77a2b738dab7989ce3feaa60c173
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: B9210C35B09BC286EE14AB75A8542BDE3A0EF88B90FD84535DE4D47B55DF3CE5408A20
                                                                                                                                                                                                                                            Function 00007FF72F9ECDD0 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 273COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72F9D11A0: _WChar_traits.LIBCPMTD ref: 00007FF72F9D11CD
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA198A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF72FA19930
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA198A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72FA1995D
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA198A0: shared_ptr.LIBCMTD ref: 00007FF72FA19993
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA198A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72FA19A2E
                                                                                                                                                                                                                                            • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72F9ECFDE
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72F9D10B0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72F9D10CD
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA18E90: shared_ptr.LIBCMTD ref: 00007FF72FA18F05
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA18E90: shared_ptr.LIBCMTD ref: 00007FF72FA18F8E
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA18E90: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72FA19190
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA52310: RegCreateKeyW.ADVAPI32 ref: 00007FF72FA52347
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA52310: RegQueryValueExW.KERNEL32 ref: 00007FF72FA52392
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA52310: RegCloseKey.ADVAPI32 ref: 00007FF72FA523A1
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            • widgetInfo, xrefs: 00007FF72F9ED19B
                                                                                                                                                                                                                                            • {"app" : { "init" : {"guid":"%ws","cache_folder_path":"%ws", "user_version":"%ws", "windows_version":"%ws", "locale_layout":"%ws, xrefs: 00007FF72F9ECE1B
                                                                                                                                                                                                                                            • {"app": {"widget":{"savedPosition": {"x": %d, "y": %d}}}}, xrefs: 00007FF72F9ED30B
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Concurrency::details::EmptyQueue::StructuredWork$shared_ptr$Char_traitsCloseCreateQueryValuetype_info::_name_internal_method
                                                                                                                                                                                                                                            • String ID: widgetInfo${"app" : { "init" : {"guid":"%ws","cache_folder_path":"%ws", "user_version":"%ws", "windows_version":"%ws", "locale_layout":"%ws${"app": {"widget":{"savedPosition": {"x": %d, "y": %d}}}}
                                                                                                                                                                                                                                            • API String ID: 2877627145-1185860185
                                                                                                                                                                                                                                            • Opcode ID: f5ef5e51fbbfe41895f03c00aad2e7452ce90bee6a6873e590239aef18585d9e
                                                                                                                                                                                                                                            • Instruction ID: 33f6b8c2419d852e9c0fc2dbf645e3e7be5cf5b545776864b084a50d2d64b868
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: f5ef5e51fbbfe41895f03c00aad2e7452ce90bee6a6873e590239aef18585d9e
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: F9F18E36609FC595DAB1AB15E8853DBB3A4FBC9780F904126DACC83B69EF38C554CB40
                                                                                                                                                                                                                                            Function 00007FF72FA189D0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 197COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72F9D0F30: char_traits.LIBCPMTD ref: 00007FF72F9D0F5D
                                                                                                                                                                                                                                            • Concurrency::task_continuation_context::task_continuation_context.LIBCPMTD ref: 00007FF72FA18B79
                                                                                                                                                                                                                                            • Concurrency::task_continuation_context::task_continuation_context.LIBCPMTD ref: 00007FF72FA18CB7
                                                                                                                                                                                                                                            • Concurrency::task_continuation_context::task_continuation_context.LIBCPMTD ref: 00007FF72FA18CDF
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            • ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/, xrefs: 00007FF72FA189EE
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Concurrency::task_continuation_context::task_continuation_context$char_traits
                                                                                                                                                                                                                                            • String ID: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/
                                                                                                                                                                                                                                            • API String ID: 3112460731-1713319389
                                                                                                                                                                                                                                            • Opcode ID: b7a086962086a4a3b8ff3ea580c156ee40cde518962ec9efe31518dd0ce3de4f
                                                                                                                                                                                                                                            • Instruction ID: d0cc6c44049079262e455e2b8d7c3654d4509bb826b4bac5a104a216e33c7fd6
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: b7a086962086a4a3b8ff3ea580c156ee40cde518962ec9efe31518dd0ce3de4f
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: D191296271C69086E724DB18E45677AF3A0F7C9708F541236E6CE87BA9DB2CD941CF10
                                                                                                                                                                                                                                            Function 00007FF72FB7F510 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 166COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Concurrency::details::_SchedulerScheduler::_shared_ptrtype_info::_name_internal_method
                                                                                                                                                                                                                                            • String ID: 2${"app": {"init":{"direction":"%c","screen_size":{"with_topbar":%d,"t":%d,"l":%d,"b":%d,"r":%d}}}}
                                                                                                                                                                                                                                            • API String ID: 3472098950-2542400605
                                                                                                                                                                                                                                            • Opcode ID: a06522b4bd3f730491a67bed43d797052308ed437248712ff05ccfc5716190a0
                                                                                                                                                                                                                                            • Instruction ID: c0f7382df5675c2b47ab2a4fba6d6d930c9e3bfda93223ae3910d13c5962c672
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: a06522b4bd3f730491a67bed43d797052308ed437248712ff05ccfc5716190a0
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: D991A336609AC596DA70EB59F88479EB7A0F7C9B80F504126DACD87B6ADF38D444CF00
                                                                                                                                                                                                                                            Function 00007FF72FB92560 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 130COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Concurrency::details::_SchedulerScheduler::_
                                                                                                                                                                                                                                            • String ID: 0u${"app": {"topbar": { "fullScreenMode": %d }}}${"app": {"topbar": { "rBinStatus": %d }}}
                                                                                                                                                                                                                                            • API String ID: 2780765137-351494797
                                                                                                                                                                                                                                            • Opcode ID: c6dc4bc9f275c3fe931e0a8b2be71623a9451d03ab54ed2b19bfb7d198c1860f
                                                                                                                                                                                                                                            • Instruction ID: b5280dd38cf423568bbcf64d852300e45c3bcebd437fe2bd04b0ea9e99b19102
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: c6dc4bc9f275c3fe931e0a8b2be71623a9451d03ab54ed2b19bfb7d198c1860f
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: AF61F332619BC185EA60AB15E8817EBB760FBC5780F805126EACD83B6ADF3CD544CF50
                                                                                                                                                                                                                                            Function 00007FF72FB80E70 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 108registryCOMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: CloseConcurrency::scheduler_worker_creation_error::scheduler_worker_creation_errorOpen
                                                                                                                                                                                                                                            • String ID: registry was not opened
                                                                                                                                                                                                                                            • API String ID: 151454242-1342567452
                                                                                                                                                                                                                                            • Opcode ID: 4d534990ae99ead2cf0873bf9dd4711f613be1f9133e9456e9cae1e23dbeabb2
                                                                                                                                                                                                                                            • Instruction ID: 6d91cf3077d0a23684a7778b37405ba16132486dde3536aa4edd7d64a07d7aae
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 4d534990ae99ead2cf0873bf9dd4711f613be1f9133e9456e9cae1e23dbeabb2
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 1751E832619AC185EA60AB15E8907DEE3A0FBC9780F905026EACD83B69DF2CD555CF10
                                                                                                                                                                                                                                            Function 00007FF72FB7F970 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: System$Metrics$FromInfoMonitorParametersPoint
                                                                                                                                                                                                                                            • String ID: (
                                                                                                                                                                                                                                            • API String ID: 865970660-3887548279
                                                                                                                                                                                                                                            • Opcode ID: 852967e46166c58f9c109281e4ef4eeba4025dd279084ef57329ba208a5198a1
                                                                                                                                                                                                                                            • Instruction ID: 753637f5108ee9c022d9efc73cde85c2f924fc07fe208df9599b1198c5dc0bd2
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 852967e46166c58f9c109281e4ef4eeba4025dd279084ef57329ba208a5198a1
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: E7317033A0C6C58AD351AB29E85416EFBB1EBC4B94F409135E68E43B55CB3CD5408F64
                                                                                                                                                                                                                                            Function 00007FF72F9DAFB0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62synchronizationCOMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72F9D11A0: _WChar_traits.LIBCPMTD ref: 00007FF72F9D11CD
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA198A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF72FA19930
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA198A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72FA1995D
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA198A0: shared_ptr.LIBCMTD ref: 00007FF72FA19993
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA198A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72FA19A2E
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72F9D10B0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72F9D10CD
                                                                                                                                                                                                                                            • OpenEventW.KERNEL32 ref: 00007FF72F9DB069
                                                                                                                                                                                                                                            • WaitForSingleObject.KERNEL32 ref: 00007FF72F9DB094
                                                                                                                                                                                                                                            • CloseHandle.KERNEL32 ref: 00007FF72F9DB0B5
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Concurrency::details::EmptyQueue::StructuredWork$Char_traitsCloseEventHandleObjectOpenSingleWaitshared_ptrtype_info::_name_internal_method
                                                                                                                                                                                                                                            • String ID: ClosingEvent
                                                                                                                                                                                                                                            • API String ID: 4183184898-2998232585
                                                                                                                                                                                                                                            • Opcode ID: e50ecc73ab863df4b7290ce45044c8f320aec8619331b9df7c66aba9001a4a80
                                                                                                                                                                                                                                            • Instruction ID: a79b397eab6429bbac04a951a7a06412ba887d8d68c58e0ab9da27c944f1f37c
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: e50ecc73ab863df4b7290ce45044c8f320aec8619331b9df7c66aba9001a4a80
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: B3313C32A08A8182E610BB64E8452ABF7A0FBC8380F905132E6CD82B7DDF3CD545CF50
                                                                                                                                                                                                                                            Function 00007FF72FC06984 Relevance: 6.2, APIs: 4, Instructions: 219COMMONLIBRARYCODE
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • GetConsoleMode.KERNEL32(?,?,?,?,?,00000000,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00007FF72FC13181), ref: 00007FF72FC06AA0
                                                                                                                                                                                                                                            • GetLastError.KERNEL32(?,?,?,?,?,00000000,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00007FF72FC13181), ref: 00007FF72FC06B2B
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: ConsoleErrorLastMode
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 953036326-0
                                                                                                                                                                                                                                            • Opcode ID: 1273d94917eb2dba32d746d92a72a75f4f9bb826b1e7eb3a4b4e5cf9036387d1
                                                                                                                                                                                                                                            • Instruction ID: 7e9d9d6df5816286850a0d0f4278aeff02167a9c6fefc8d77da4a81b224ff343
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 1273d94917eb2dba32d746d92a72a75f4f9bb826b1e7eb3a4b4e5cf9036387d1
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: C8919462F086E155F750BF69A8402FDABA0EB04B88F944139DE0E57695DF38D4C6DF20
                                                                                                                                                                                                                                            Function 00007FF72FA198A0 Relevance: 6.1, APIs: 4, Instructions: 101COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72F9D11A0: _WChar_traits.LIBCPMTD ref: 00007FF72F9D11CD
                                                                                                                                                                                                                                            • type_info::_name_internal_method.LIBCMTD ref: 00007FF72FA19930
                                                                                                                                                                                                                                            • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72FA1995D
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA189D0: Concurrency::task_continuation_context::task_continuation_context.LIBCPMTD ref: 00007FF72FA18B79
                                                                                                                                                                                                                                            • shared_ptr.LIBCMTD ref: 00007FF72FA19993
                                                                                                                                                                                                                                            • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72FA19A2E
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA17D60: UnDecorator::getVbTableType.LIBCMTD ref: 00007FF72FA17D7A
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Concurrency::details::EmptyQueue::StructuredWork$Char_traitsConcurrency::task_continuation_context::task_continuation_contextDecorator::getTableTypeshared_ptrtype_info::_name_internal_method
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 4040233825-0
                                                                                                                                                                                                                                            • Opcode ID: 42c90e878669586546bd47c4aac059a84cf45b7df95969407fa1727e5b9069fb
                                                                                                                                                                                                                                            • Instruction ID: 8c9bb6770a8e163a9ad49cc3b3cb475f6d4dfe7ba6ed87e8ec0224b52624eb61
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 42c90e878669586546bd47c4aac059a84cf45b7df95969407fa1727e5b9069fb
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: DC411B3261DAC691DA20EB25E8517EBF760FBC5780F901532E6CD83AAADE2CD544CF50
                                                                                                                                                                                                                                            Function 00007FF72FA1B0C0 Relevance: 6.1, APIs: 4, Instructions: 78synchronizationCOMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Concurrency::details::EmptyQueue::StructuredWork$ObjectSingleWait
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 282557418-0
                                                                                                                                                                                                                                            • Opcode ID: e84f3ad846ed64f9196f56f3fe06c159fe096eb6db7144feb365fa05972e167c
                                                                                                                                                                                                                                            • Instruction ID: b41ed99b452abcfb98b0fd5cb46481a5083d9229549a2dd170d6532fc84f6a69
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: e84f3ad846ed64f9196f56f3fe06c159fe096eb6db7144feb365fa05972e167c
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 75315411F09AC642EE10A71DD8456AFA3B0FF867C4FD12135EA8D07796DE2CD4428F14
                                                                                                                                                                                                                                            Function 00007FF72FA52420 Relevance: 6.1, APIs: 4, Instructions: 74registrystringCOMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: CloseCreateQueryValuestrrchr
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 2429320508-0
                                                                                                                                                                                                                                            • Opcode ID: 7c12e76c81dc16c8822931cc68bfae7e375ac47037923e780dd9e0743e314af7
                                                                                                                                                                                                                                            • Instruction ID: 653f4063c389a4d28db9a8aa87c8ead7b337b624ed11fd3bdc12351c3af618ff
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 7c12e76c81dc16c8822931cc68bfae7e375ac47037923e780dd9e0743e314af7
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 3A31F632A19AC582D650FB25E8816ABF360FBC5780F905536EACD83AADDF3CD4448F50
                                                                                                                                                                                                                                            Function 00007FF72FA6F480 Relevance: 6.1, APIs: 4, Instructions: 60comfileCOMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: CreateInitialize$FileIcmpInstanceSecurity
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 897544864-0
                                                                                                                                                                                                                                            • Opcode ID: e4a8fba4a3a2cf6652689b814b655aac69ce770b39fc8cbd7eb8e22504de9c34
                                                                                                                                                                                                                                            • Instruction ID: 502f620ea1c29e7e2c6561d91930e4bbc359f7c7d9581e8411dba77ae8dff835
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: e4a8fba4a3a2cf6652689b814b655aac69ce770b39fc8cbd7eb8e22504de9c34
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 3F31DD36B08B8982EB00EF2AF85575EB761FB85B54F504135EA9D077A5CF3DE0458B10
                                                                                                                                                                                                                                            Function 00007FF72FA52310 Relevance: 6.1, APIs: 4, Instructions: 58registryCOMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Close$CreateQueryValue
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 2495337196-0
                                                                                                                                                                                                                                            • Opcode ID: 560ce2b6002fda1f48c0e2119564795e5af3fb434074bb728d858a953253bbc0
                                                                                                                                                                                                                                            • Instruction ID: 097d3bf6f322f0fbfcb73f39b13cb0044d13ca58712a61c19a9563d14d7fc8e8
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 560ce2b6002fda1f48c0e2119564795e5af3fb434074bb728d858a953253bbc0
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 6C21DA22A1DAC182EA40AB25F8555AFB7A0FBC5784F901036F6CE87A69CF2CD4448F50
                                                                                                                                                                                                                                            Function 00007FF72FA525A0 Relevance: 6.1, APIs: 4, Instructions: 56registryCOMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • RegCreateKeyW.ADVAPI32 ref: 00007FF72FA525CE
                                                                                                                                                                                                                                            • RegSetValueExW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF72F9EF86D), ref: 00007FF72FA5261A
                                                                                                                                                                                                                                            • RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF72F9EF86D), ref: 00007FF72FA52629
                                                                                                                                                                                                                                            • RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF72F9EF86D), ref: 00007FF72FA52657
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Close$CreateValue
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 1009429713-0
                                                                                                                                                                                                                                            • Opcode ID: 7276f55dccbbdba195227a01b48dd228f0e69ce8f0cf39afd03d7a8aeece0958
                                                                                                                                                                                                                                            • Instruction ID: 3fef72533c786e29ec2c4af9e4346c1dbc05b5b9a3ca30176e6e4c250669b298
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 7276f55dccbbdba195227a01b48dd228f0e69ce8f0cf39afd03d7a8aeece0958
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 1021F162A1CAC182E650BB25E85556FF7A0FBC5784F901036F6CE87A69CF2CD4448F50
                                                                                                                                                                                                                                            Function 00007FF72FB822D0 Relevance: 6.0, APIs: 4, Instructions: 45registrywindowCOMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: ChangeCloseDecorator::getExceptionFileFormatHeaderMessageNotifyRaiseTableTypeValuestd::bad_exception::bad_exception
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 364703902-0
                                                                                                                                                                                                                                            • Opcode ID: eb16407a55bedfc082493dc2b5cacc50af7eef1171e8d3171c4d170d14618321
                                                                                                                                                                                                                                            • Instruction ID: d4b38df4fbf0d934977a02ceaac864bcba9b29405f09826aa2c1d0aa250f54a1
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: eb16407a55bedfc082493dc2b5cacc50af7eef1171e8d3171c4d170d14618321
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: ED210872618A8586E720AB25F84439EB7A0F7C5788F904035E68D43BA9DF7DD549CF10
                                                                                                                                                                                                                                            Function 00007FF72FA7B750 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 74COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72F9D11A0: _WChar_traits.LIBCPMTD ref: 00007FF72F9D11CD
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA198A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF72FA19930
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA198A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72FA1995D
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA198A0: shared_ptr.LIBCMTD ref: 00007FF72FA19993
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA198A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72FA19A2E
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA18E90: shared_ptr.LIBCMTD ref: 00007FF72FA18F05
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA18E90: shared_ptr.LIBCMTD ref: 00007FF72FA18F8E
                                                                                                                                                                                                                                            • Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FF72FA7B826
                                                                                                                                                                                                                                            • HandleT.LIBCPMTD ref: 00007FF72FA7B835
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA7B6E0: OpenProcess.KERNEL32(?,?,?,?,?,?,?,?,00007FF72FA7B882), ref: 00007FF72FA7B709
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: shared_ptr$Concurrency::details::EmptyQueue::StructuredWork$Char_traitsConcurrency::details::_CriticalHandleLock::_OpenProcessReentrantScoped_lockScoped_lock::~_type_info::_name_internal_method
                                                                                                                                                                                                                                            • String ID: NW_store.exe
                                                                                                                                                                                                                                            • API String ID: 131083509-3827304589
                                                                                                                                                                                                                                            • Opcode ID: 44cfe3a068b61534521f87d988c987f70c68ee5fcbd69b41f073ec8c29d83b17
                                                                                                                                                                                                                                            • Instruction ID: 70c29412e9c2b1ca59a832bb6a27cb5226b1df3d4a310b42a0f438a54ce0db36
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 44cfe3a068b61534521f87d988c987f70c68ee5fcbd69b41f073ec8c29d83b17
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 4F41B732A0DAC185EA60AB15E8407AEF7A0FBC5784F900136E6CD86BA9DF3CD544CF50
                                                                                                                                                                                                                                            Function 00007FF72FA1AF80 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63timeCOMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72F9D11A0: _WChar_traits.LIBCPMTD ref: 00007FF72F9D11CD
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA198A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF72FA19930
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA198A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72FA1995D
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA198A0: shared_ptr.LIBCMTD ref: 00007FF72FA19993
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA198A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72FA19A2E
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA18E90: shared_ptr.LIBCMTD ref: 00007FF72FA18F05
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA18E90: shared_ptr.LIBCMTD ref: 00007FF72FA18F8E
                                                                                                                                                                                                                                            • WinHttpOpen.WINHTTP ref: 00007FF72FA1B00E
                                                                                                                                                                                                                                            • WinHttpSetTimeouts.WINHTTP ref: 00007FF72FA1B080
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: shared_ptr$Concurrency::details::EmptyHttpQueue::StructuredWork$Char_traitsOpenTimeoutstype_info::_name_internal_method
                                                                                                                                                                                                                                            • String ID: WinHTTP 1.0
                                                                                                                                                                                                                                            • API String ID: 2528808869-2851767304
                                                                                                                                                                                                                                            • Opcode ID: 2e24871aa67713a592dbdd8c4c6f66b0876173e6e055371193df7ccb10404f13
                                                                                                                                                                                                                                            • Instruction ID: 70499e9cbf18db2e32738f87ad48dd536eb68c14ca97d8bcbe2a9fb9f36f5cc2
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 2e24871aa67713a592dbdd8c4c6f66b0876173e6e055371193df7ccb10404f13
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: D1313B32A18AC186E610EB14E8447AFB7A0FBC5784F905035E68E87BA8DF7CD444CF40
                                                                                                                                                                                                                                            Function 00007FF72FA18E90 Relevance: 4.7, APIs: 3, Instructions: 168COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Decorator::getTableType$shared_ptr$Char_traitsConcurrency::details::EmptyQueue::StructuredWork
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 43780872-0
                                                                                                                                                                                                                                            • Opcode ID: b84b4a2511fb982144c7d429468c844d9ab2def749891cb9dbf0faf9c5b57989
                                                                                                                                                                                                                                            • Instruction ID: d0750ad8f977e00ac57b2df20b3d40fedcb983ac6138fe3d07d96e507957f356
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: b84b4a2511fb982144c7d429468c844d9ab2def749891cb9dbf0faf9c5b57989
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: AF81D732619AC591DA70AB15E8917EBB360FBC9784F805532E6CD83BAADE2CD504CF50
                                                                                                                                                                                                                                            Function 00007FF72FA19AA0 Relevance: 4.6, APIs: 3, Instructions: 108COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72F9D11A0: _WChar_traits.LIBCPMTD ref: 00007FF72F9D11CD
                                                                                                                                                                                                                                            • type_info::_name_internal_method.LIBCMTD ref: 00007FF72FA19B51
                                                                                                                                                                                                                                            • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72FA19B8C
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA189D0: Concurrency::task_continuation_context::task_continuation_context.LIBCPMTD ref: 00007FF72FA18B79
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA17D60: UnDecorator::getVbTableType.LIBCMTD ref: 00007FF72FA17D7A
                                                                                                                                                                                                                                            • shared_ptr.LIBCMTD ref: 00007FF72FA19BC8
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Char_traitsConcurrency::details::Concurrency::task_continuation_context::task_continuation_contextDecorator::getEmptyQueue::StructuredTableTypeWorkshared_ptrtype_info::_name_internal_method
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 2402306799-0
                                                                                                                                                                                                                                            • Opcode ID: 1d91c1566532990faaf23e5970af6109f64c42692b4b7ac5f6dcc6cf0e6778d5
                                                                                                                                                                                                                                            • Instruction ID: 661f895bb9d8dfae7f40be744452f5cc291dc84b71e7c669506880d59d7058e1
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 1d91c1566532990faaf23e5970af6109f64c42692b4b7ac5f6dcc6cf0e6778d5
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 8551E43261DAC691DA70EB15E8907EBA760FBC5784F905032E6CD83AAADE2CD544CF50
                                                                                                                                                                                                                                            Function 00007FF72FBC4E5C Relevance: 4.6, APIs: 3, Instructions: 95COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Lockitstd::_$Concurrency::cancel_current_taskLockit::_Lockit::~_
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 2115809835-0
                                                                                                                                                                                                                                            • Opcode ID: 07c789e1ecde46cafee3303e34b0fc3d8b8e57067b5349540f45eb19f28a0c0b
                                                                                                                                                                                                                                            • Instruction ID: 8c522e8d33c65312c58942c84adcda5f53420edb185a46413be0831cca6fd308
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 07c789e1ecde46cafee3303e34b0fc3d8b8e57067b5349540f45eb19f28a0c0b
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 55417E36708B8581EB18EF25E9502ADA360FB88FC4F804431DE4D43B69DE3CD955CB50
                                                                                                                                                                                                                                            Function 00007FF72F9CB5D0 Relevance: 4.6, APIs: 3, Instructions: 89COMMONLIBRARYCODE
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Concurrency::details::EmptyQueue::StructuredWorkchar_traits$Max_valueMin_value
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 2926028262-0
                                                                                                                                                                                                                                            • Opcode ID: e39de02eebfb42b1296a69f08ef3f680c82487d490f3d30a3846c76b507564e3
                                                                                                                                                                                                                                            • Instruction ID: ea6068a3752e138600caa074ce705fc20d499c9fe7163c01729b277a654cbacb
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: e39de02eebfb42b1296a69f08ef3f680c82487d490f3d30a3846c76b507564e3
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 9241FB26A1DB8582DA10EB16F4501AEB7A4FBC9794F501136FACD83B6ECE3CD5408F50
                                                                                                                                                                                                                                            Function 00007FF72FA28DC0 Relevance: 4.6, APIs: 3, Instructions: 84COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72F9F3D50: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72F9F3D6D
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72F9F3D50: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72F9F3DCA
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72F9F3D50: allocator.LIBCONCRTD ref: 00007FF72F9F3DFC
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72F9F4260: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72F9F4285
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72F9F4260: allocator.LIBCONCRTD ref: 00007FF72F9F42B4
                                                                                                                                                                                                                                            • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72FA28E59
                                                                                                                                                                                                                                            • shared_ptr.LIBCMTD ref: 00007FF72FA28E8A
                                                                                                                                                                                                                                            • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72FA28EA9
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Concurrency::details::EmptyQueue::StructuredWork$allocator$shared_ptr
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 2521778909-0
                                                                                                                                                                                                                                            • Opcode ID: bc28f64a0aae393edbfbfc410914c15dd57eb91a0f957500b21aa2ed5c8e3ba9
                                                                                                                                                                                                                                            • Instruction ID: 4fe3c03e2d6d4194cb4c63584feea8fa59dd39e00b66d6c9bb49394123fea4f7
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: bc28f64a0aae393edbfbfc410914c15dd57eb91a0f957500b21aa2ed5c8e3ba9
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 8C41D222619AC581DA60AB15F8803EFA760FBC4780F804536EACE93B6ADE7CD4548F50
                                                                                                                                                                                                                                            Function 00007FF72FA643D0 Relevance: 4.6, APIs: 3, Instructions: 79COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72FA643F2
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA45CE0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72FA45CF1
                                                                                                                                                                                                                                            • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72FA64475
                                                                                                                                                                                                                                            • _Bitmask_includes.LIBCPMTD ref: 00007FF72FA644DC
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Concurrency::details::EmptyQueue::StructuredWork$Bitmask_includes
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 2390111963-0
                                                                                                                                                                                                                                            • Opcode ID: a83db4324a4abcfd552098a8bf7e40096f33cd78f084c4a2e058ad9279e2f5f2
                                                                                                                                                                                                                                            • Instruction ID: 88ea3e387bb36cea1a12a2c258ea5cbf4ea71efeb0b98ae458fe06e4ebc1455b
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: a83db4324a4abcfd552098a8bf7e40096f33cd78f084c4a2e058ad9279e2f5f2
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: CD41FE21B1C5C186DA60EB15E8457EAF3A0FB86784F800135EACD87A9EDF2CD5448F50
                                                                                                                                                                                                                                            Function 00007FF72FBA7830 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 181COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72FBA7944
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72F9D0E90: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72F9D0EAD
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FB9B680: _Idl_distance.LIBCPMTD ref: 00007FF72FB9B6CF
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72F9D0F30: char_traits.LIBCPMTD ref: 00007FF72F9D0F5D
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA19AA0: type_info::_name_internal_method.LIBCMTD ref: 00007FF72FA19B51
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA19AA0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72FA19B8C
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA19AA0: shared_ptr.LIBCMTD ref: 00007FF72FA19BC8
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA19580: shared_ptr.LIBCMTD ref: 00007FF72FA195B3
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA19580: shared_ptr.LIBCMTD ref: 00007FF72FA1963C
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Concurrency::details::EmptyQueue::StructuredWorkshared_ptr$Idl_distancechar_traitstype_info::_name_internal_method
                                                                                                                                                                                                                                            • String ID: profile
                                                                                                                                                                                                                                            • API String ID: 4115068943-2170006031
                                                                                                                                                                                                                                            • Opcode ID: da7cbc0b189f4bb860de1ce21873313a16534c6027e4202c4bd7159d22c8c264
                                                                                                                                                                                                                                            • Instruction ID: 15ae9746a0ac8d7b48c00a0ee98048b65b3d7194d780cab82474945e0a43284d
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: da7cbc0b189f4bb860de1ce21873313a16534c6027e4202c4bd7159d22c8c264
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: BE91DA7260DAC691DA71AB15E8913EFB360FBC5780F905036E6CD83AA9DE2CD544CF50
                                                                                                                                                                                                                                            Function 00007FF72FA39C90 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 52processCOMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: CreateProcessstrrchr
                                                                                                                                                                                                                                            • String ID: h
                                                                                                                                                                                                                                            • API String ID: 4037516736-2439710439
                                                                                                                                                                                                                                            • Opcode ID: 0b4d67693e087f15374fe2cb39532bd0f8a7dd7e7352cbe55a5af5981feb850d
                                                                                                                                                                                                                                            • Instruction ID: 398b6d51f53e9935efd4bf3305c66538e51d755808416a537a346a2b9b5707ae
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 0b4d67693e087f15374fe2cb39532bd0f8a7dd7e7352cbe55a5af5981feb850d
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: F621F532618A8182E710EB54F8957ABF7A0FBD5384F904025E68D82AA9DFBCD418CF40
                                                                                                                                                                                                                                            Function 00007FF72FA25510 Relevance: 3.2, APIs: 2, Instructions: 229COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 00007FF72FA258D1
                                                                                                                                                                                                                                            • Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 00007FF72FA25990
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Affinity::operator!=Concurrency::details::Hardware
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 264382594-0
                                                                                                                                                                                                                                            • Opcode ID: cfc5a942827d7b234bbfae95b47227cb9bcd75ae4e209f24ddefbee3c6f8f98f
                                                                                                                                                                                                                                            • Instruction ID: 90239588f6248e1be5afd60bcb2e36c80529783d3b49b754f97c54f2e07d1926
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: cfc5a942827d7b234bbfae95b47227cb9bcd75ae4e209f24ddefbee3c6f8f98f
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 10D1C626608BC585D670EB15E8907AEB7A0FBC9B80F448532DACE97B5ACF7CD4448F50
                                                                                                                                                                                                                                            Function 00007FF72FBF6858 Relevance: 3.1, APIs: 2, Instructions: 132COMMONLIBRARYCODE
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 3215553584-0
                                                                                                                                                                                                                                            • Opcode ID: e880bca60e20fa46b069a9fa51f681df6431c92be232c2e0220b988f896fe569
                                                                                                                                                                                                                                            • Instruction ID: 0c41e28c323067c27445f7b7433ceecd24fedb092f36a7a5c4af443a5b7730d5
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: e880bca60e20fa46b069a9fa51f681df6431c92be232c2e0220b988f896fe569
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 9E51E332F0928187FE64AB2CAC506BDB3A0EB55B54F900635DA8E46791CF2CE543CF61
                                                                                                                                                                                                                                            Function 00007FF72FBF689C Relevance: 3.1, APIs: 2, Instructions: 77COMMONLIBRARYCODE
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 3215553584-0
                                                                                                                                                                                                                                            • Opcode ID: 6a5b8f90e18411c57f8b0fba21bd4e9db6e17063562557f0c65fbbde9f2cf7de
                                                                                                                                                                                                                                            • Instruction ID: b443d1e98d57f7382c11eec66bafe5b8c339c781ffb38e80860fa219214fa12d
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 6a5b8f90e18411c57f8b0fba21bd4e9db6e17063562557f0c65fbbde9f2cf7de
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: A8318B32B18AC641EB50BB34E8511FDA362EB98B80FD45235E94E47292EE3DE5048F20
                                                                                                                                                                                                                                            Function 00007FF72FA8E0E0 Relevance: 3.1, APIs: 2, Instructions: 76COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Concurrency::details::_CriticalHandleLock::_ReentrantScoped_lockScoped_lock::~_
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 1248567937-0
                                                                                                                                                                                                                                            • Opcode ID: 92389566394e26f0760bd2fcd94081680548d2ff32db7593174330b41cdd25df
                                                                                                                                                                                                                                            • Instruction ID: 1e2bb6bc5c291cf5a88ac673418e23422bebfc8efbe343dd3ca825a2b86bf868
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 92389566394e26f0760bd2fcd94081680548d2ff32db7593174330b41cdd25df
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 2B314F32A0DAC581DA20EB55E8802EEE770FBD6784F900032E6CD87B69DFACC5048F50
                                                                                                                                                                                                                                            Function 00007FF72FA7C8F0 Relevance: 3.1, APIs: 2, Instructions: 57COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Concurrency::details::_CriticalHandleLock::_ReentrantScoped_lockScoped_lock::~_
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 1248567937-0
                                                                                                                                                                                                                                            • Opcode ID: a1149c2a858c994460a24516dda6707a1043169a9f523b488fa632f13db00f5f
                                                                                                                                                                                                                                            • Instruction ID: 643117f5a87074fa216f23c55caf7f3e4edbd18a3205aea20765fb2e935818db
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: a1149c2a858c994460a24516dda6707a1043169a9f523b488fa632f13db00f5f
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: D221352261CAC181E660A719E8415AFEBB4EBC6784F940136F7CD867AADF2CC5518F20
                                                                                                                                                                                                                                            Function 00007FF72FB823C0 Relevance: 3.1, APIs: 2, Instructions: 57registryCOMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: QueryValue
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 3660427363-0
                                                                                                                                                                                                                                            • Opcode ID: 8255e4681818947f7ead3aea93db6fb5ee972568b12f96a755b376553cfc7fd9
                                                                                                                                                                                                                                            • Instruction ID: 90cf4afd9c4a1fcd68308c993778a2c7b5191bf7136257313a75bf688364fad7
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 8255e4681818947f7ead3aea93db6fb5ee972568b12f96a755b376553cfc7fd9
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 0421B936A29B8182DA509B29E88465EB3A4FBC5794F941125FBCE43B28DF3CD844CF10
                                                                                                                                                                                                                                            Function 00007FF72FA1EBD0 Relevance: 3.0, APIs: 2, Instructions: 42COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: CallDecorator::getIndexatomicshared_ptr
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 3391904811-0
                                                                                                                                                                                                                                            • Opcode ID: 112a7a1cfea1af6a49f72f60085d69459d96c49a4b2313b8b527eccd42334bbb
                                                                                                                                                                                                                                            • Instruction ID: 99096a7550e65adfcd45a0bed332d311cf05e3af98855bb114b9abc1cee50262
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 112a7a1cfea1af6a49f72f60085d69459d96c49a4b2313b8b527eccd42334bbb
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: F5119436628A8586DB50EB19E88159EB7B0FBC5B84F905122EB8E43B69DF3CC514CF00
                                                                                                                                                                                                                                            Function 00007FF72F9FBA60 Relevance: 3.0, APIs: 2, Instructions: 34COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72F9FBA6E
                                                                                                                                                                                                                                            • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72F9FBAA4
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Concurrency::details::EmptyQueue::StructuredWork
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 1865873047-0
                                                                                                                                                                                                                                            • Opcode ID: 162308b701f32d424d0eb419049066e29dbf585e8b94c20370081b5761ee0531
                                                                                                                                                                                                                                            • Instruction ID: 449d4878d08f7d874c1fad2e5b5de40c8315b2af6559c7290e410f1bc29909aa
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 162308b701f32d424d0eb419049066e29dbf585e8b94c20370081b5761ee0531
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: B1112376618B8481CA60EB56F49125AB7A4F7CCBD4F554126EECD83B29CE3CC5508F40
                                                                                                                                                                                                                                            Function 00007FF72FBE2BD0 Relevance: 3.0, APIs: 2, Instructions: 21COMMONLIBRARYCODE
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Concurrency::cancel_current_task$std::bad_alloc::bad_alloc
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 1173176844-0
                                                                                                                                                                                                                                            • Opcode ID: 79828b8057ac0c13fd60be7f73fd30bcbbf421bb2b822df6622cab7814d851e4
                                                                                                                                                                                                                                            • Instruction ID: 0d8eeabfcd225e47cc0f9f6dd7ff3e6d9675e1edc0ece8f971bdfab296f14321
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 79828b8057ac0c13fd60be7f73fd30bcbbf421bb2b822df6622cab7814d851e4
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 4BE0EC44F0E1CB45FA583B755C552FD9140CF19770EEC5B30E93E042C2EE1CA4969A30
                                                                                                                                                                                                                                            Function 00007FF72FC00DD4 Relevance: 3.0, APIs: 2, Instructions: 18memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: ErrorFreeHeapLast
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 485612231-0
                                                                                                                                                                                                                                            • Opcode ID: b14f49c57cee8635011c431eaae8e23fe290bbf5ee1f602fc278b6c7871e509f
                                                                                                                                                                                                                                            • Instruction ID: 5adeed21d22293928ccc25c62807acc02b64cd3f7e286a3d024d43d831013dc0
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: b14f49c57cee8635011c431eaae8e23fe290bbf5ee1f602fc278b6c7871e509f
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: B0E01250F096C643FE1877F67C551F99251DF98F50FC80034C91D52252EE1CA6D54B60
                                                                                                                                                                                                                                            Function 00007FF72FA717A0 Relevance: 3.0, APIs: 2, Instructions: 16COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Window$ShowUpdate
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 2310006639-0
                                                                                                                                                                                                                                            • Opcode ID: 27d96b2e2a6ebb7af6f79fd039629226fea3c2d1ac42639d18c704751faeff7c
                                                                                                                                                                                                                                            • Instruction ID: 692bd4a371349b19e4ef393818c6e7354cb14c3b69e0f2ab19fe2a0c1aebe90a
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 27d96b2e2a6ebb7af6f79fd039629226fea3c2d1ac42639d18c704751faeff7c
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 46E01A36B25A8582EB40AF26EC80669A7B0F7C4F80F818021EE4D43324DF38C4858B00
                                                                                                                                                                                                                                            Function 00007FF72F9F9000 Relevance: 3.0, APIs: 2, Instructions: 13COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72F9F900E
                                                                                                                                                                                                                                            • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72F9F901D
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Concurrency::details::EmptyQueue::StructuredWork
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 1865873047-0
                                                                                                                                                                                                                                            • Opcode ID: 05b1032d986fd76fd535be3819b66012f06ae3da9b1219c790b6385ed1ae1121
                                                                                                                                                                                                                                            • Instruction ID: 9b798e299052d97172069c1aff832d109d0b76bec720bf093dcd8f73a546a342
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 05b1032d986fd76fd535be3819b66012f06ae3da9b1219c790b6385ed1ae1121
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 21D06722A599C181DA50BB21EC561AEA374FBC5784FA04536EECDC776ACE2CD5218F10
                                                                                                                                                                                                                                            Function 00007FF72FA8CB80 Relevance: 3.0, APIs: 2, Instructions: 10COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: ChildDesktopEnumWindowWindows
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 2514311848-0
                                                                                                                                                                                                                                            • Opcode ID: b0fd43d6e0e94c28da821d992680c33c943c97e8262ce344efbf5b071f0ff684
                                                                                                                                                                                                                                            • Instruction ID: 59e6f8771168474dd7b053cc62cd3a2a2a054dae36720b602567c1022576a202
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: b0fd43d6e0e94c28da821d992680c33c943c97e8262ce344efbf5b071f0ff684
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 98C01275F16786C2DA047B79FC995646370FF4E741FD09030C40D01610CE2CA09D8F10
                                                                                                                                                                                                                                            Function 00007FF72F9D97A0 Relevance: 3.0, APIs: 2, Instructions: 10COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: ChildDesktopEnumWindowWindows
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 2514311848-0
                                                                                                                                                                                                                                            • Opcode ID: 815231a326fdbdcc2087a3ba038e825c9bf287463471365a8762f450db156d53
                                                                                                                                                                                                                                            • Instruction ID: df6ea8ed8922559c3d8c64960f399979737f795c9381f85691c30e22c220b5e5
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 815231a326fdbdcc2087a3ba038e825c9bf287463471365a8762f450db156d53
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 49C0C965F16786C6DA047B79BC991646260EF4D741FD09030C44901614CE2CA0998F10
                                                                                                                                                                                                                                            Function 00007FF72FA61C90 Relevance: 1.6, APIs: 1, Instructions: 124COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: std::ios_base::goodstd::ios_base::width
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 3809604888-0
                                                                                                                                                                                                                                            • Opcode ID: 3193a1262e75117fb15c433224b95aaa7245344bdfe751e5dc239a77d01d1b28
                                                                                                                                                                                                                                            • Instruction ID: a9d5de0bf15d79aa817f55e57470e62f5f322a2951fa45260440583cb250188f
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 3193a1262e75117fb15c433224b95aaa7245344bdfe751e5dc239a77d01d1b28
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 7E51E062B0C6858AEB60EB25E4517AEB7B0EB86784F504139E6CE87799DE3CD5008F50
                                                                                                                                                                                                                                            Function 00007FF72FA3C490 Relevance: 1.6, APIs: 1, Instructions: 93COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • GetWindowTextW.USER32 ref: 00007FF72FA3C4C6
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA18E90: shared_ptr.LIBCMTD ref: 00007FF72FA18F05
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA18E90: shared_ptr.LIBCMTD ref: 00007FF72FA18F8E
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA18E90: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72FA19190
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: shared_ptr$Concurrency::details::EmptyQueue::StructuredTextWindowWork
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 2447981796-0
                                                                                                                                                                                                                                            • Opcode ID: b9d9d1665d410959826985c3fd1ff9749f565e3fb23e1f5d9c3ca40d19348786
                                                                                                                                                                                                                                            • Instruction ID: b695552031309df33d567a061692247602a2117b605d14e84daab46b10e5e7a1
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: b9d9d1665d410959826985c3fd1ff9749f565e3fb23e1f5d9c3ca40d19348786
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: E5410D3261CAC186E620AB15E8417AFF7A4FBC5744F900236E6CD82AA9DF3CD544CF10
                                                                                                                                                                                                                                            Function 00007FF72FA2A3F0 Relevance: 1.6, APIs: 1, Instructions: 87COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: __crt_scoped_stack_ptr
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 1704660383-0
                                                                                                                                                                                                                                            • Opcode ID: 2b64867363028eff0c91442592d46d6c6cb3060f987761c6e3f93457ab4b6b66
                                                                                                                                                                                                                                            • Instruction ID: d149ad6d1d4ba8d138e83d2f35db83b04b37c46db9f42435f996b6dfef9f57ec
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 2b64867363028eff0c91442592d46d6c6cb3060f987761c6e3f93457ab4b6b66
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 0F41F76260DAC582DA60AB15E8507ABF7B0FBC6784F804122EACD87B69DF3CD544CF50
                                                                                                                                                                                                                                            Function 00007FF72FC05314 Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 3215553584-0
                                                                                                                                                                                                                                            • Opcode ID: 321343d00294838cecd101b12ef5f71ea6e8db055736ae24a32fa14de0d5b621
                                                                                                                                                                                                                                            • Instruction ID: eac574cad3dd72f371401e1c2498df36f6f8b475ae6520433ef52f6c7c71da30
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 321343d00294838cecd101b12ef5f71ea6e8db055736ae24a32fa14de0d5b621
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 8B31A361F186C187E7007B69AC513FDA660EB84B60FC10939E91C433D3CEBCE582CA20
                                                                                                                                                                                                                                            Function 00007FF72FB80210 Relevance: 1.6, APIs: 1, Instructions: 67COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • CreateEventW.KERNEL32 ref: 00007FF72FB80238
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FB80D40: _Ptr_base.LIBCPMTD ref: 00007FF72FB80E31
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FB822D0: RegNotifyChangeKeyValue.KERNEL32 ref: 00007FF72FB82308
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FB822D0: FormatMessageW.KERNEL32 ref: 00007FF72FB82353
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FB822D0: RegCloseKey.ADVAPI32 ref: 00007FF72FB8236C
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FB822D0: std::bad_exception::bad_exception.LIBCMTD ref: 00007FF72FB8238D
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: ChangeCloseCreateEventFormatMessageNotifyPtr_baseValuestd::bad_exception::bad_exception
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 1108121324-0
                                                                                                                                                                                                                                            • Opcode ID: d131e54128c23b049350c72a160e8f6a443448de3b4584595088c6dbcf7bcdaa
                                                                                                                                                                                                                                            • Instruction ID: 1354eeac13e45789fae61f85af9d56547dc2f5e3223f4c62fb24e75a44e3d388
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: d131e54128c23b049350c72a160e8f6a443448de3b4584595088c6dbcf7bcdaa
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 4C31C432619BC581DAA0EB25F88429EB3A0F7C8780F505126EACD83B29DF3CD0558F40
                                                                                                                                                                                                                                            Function 00007FF72FB7E070 Relevance: 1.6, APIs: 1, Instructions: 61COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Initialize
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 2538663250-0
                                                                                                                                                                                                                                            • Opcode ID: 56cb18ff6626b283ffe465cba34704dc4daad80764cd781178f4e76e5ddfb6ff
                                                                                                                                                                                                                                            • Instruction ID: bbceaa953bbc1390b4d6e08ec9e43c8516c6023cb08a583bd1326ca3527ced52
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 56cb18ff6626b283ffe465cba34704dc4daad80764cd781178f4e76e5ddfb6ff
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 8621F636A1CB8182DA10EB29E8511AEA3A1FBC5784F904535EACD47B69DF3CD0518F10
                                                                                                                                                                                                                                            Function 00007FF72FB80D40 Relevance: 1.6, APIs: 1, Instructions: 58COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Ptr_baseRef_count_baseRef_count_base::_std::_
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 1305008675-0
                                                                                                                                                                                                                                            • Opcode ID: a63b27ea6810d4f19100fe72ce9d08e0d90dad19ea0bee4daec0c1428a8f0f12
                                                                                                                                                                                                                                            • Instruction ID: fe3a2af7888851045ed8c9cb5189dabe742a6de9f3a28ed30a5c997dae86358e
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: a63b27ea6810d4f19100fe72ce9d08e0d90dad19ea0bee4daec0c1428a8f0f12
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 2A31A332618B8482E650AB19F8413AFB7A4FBC5780F500526EBCE47B6ADF3CD4548F50
                                                                                                                                                                                                                                            Function 00007FF72FC10B14 Relevance: 1.6, APIs: 1, Instructions: 54COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 3215553584-0
                                                                                                                                                                                                                                            • Opcode ID: e48b0f802f846f83354f8bcc0381103829573c63fa65d85b6fc9dff923b52bf1
                                                                                                                                                                                                                                            • Instruction ID: a4db082004874922f39f89f293575c4b88439567618c6ac273bdfd8629db78f3
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: e48b0f802f846f83354f8bcc0381103829573c63fa65d85b6fc9dff923b52bf1
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 5F219832708AC146DB61AF1CE8407BAB660EB84F64F945234E65E476D5DF3DD550CF10
                                                                                                                                                                                                                                            Function 00007FF72FBF0240 Relevance: 1.6, APIs: 1, Instructions: 54COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 3215553584-0
                                                                                                                                                                                                                                            • Opcode ID: bbdd6f4acd2c37f0f0cea18607fb670f7e5b7d0a06c147e43de415a555d17051
                                                                                                                                                                                                                                            • Instruction ID: 12d7d8ad34ec0e90599d5b8c3cd34a0f26a1b642819b791762900bfea29652a5
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: bbdd6f4acd2c37f0f0cea18607fb670f7e5b7d0a06c147e43de415a555d17051
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 52113B21F1C6C181EB60BF65AD102FEE260EF94B80FC44531FA8C57696CE3DDA419B60
                                                                                                                                                                                                                                            Function 00007FF72FA20710 Relevance: 1.6, APIs: 1, Instructions: 51COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72FA2072D
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Concurrency::details::EmptyQueue::StructuredWork
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 1865873047-0
                                                                                                                                                                                                                                            • Opcode ID: 5b9532d6c405fbd466589f246e8e2e23bbd78e35ef62e590e037beb5cd3c1100
                                                                                                                                                                                                                                            • Instruction ID: 8a9ce92c6a617a2189593273af736e106cbbd3f379273c135fb264be07fd0f5a
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 5b9532d6c405fbd466589f246e8e2e23bbd78e35ef62e590e037beb5cd3c1100
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 2621D236618F8482DA50EB19F88129AB7B4F7C8B80F905126EBCD83B69CF3CC4508F00
                                                                                                                                                                                                                                            Function 00007FF72F9CEC10 Relevance: 1.5, APIs: 1, Instructions: 49COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Cpp_errorThrow__invalid_parameter_noinfostd::_
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 162856716-0
                                                                                                                                                                                                                                            • Opcode ID: 4feafb8df3604776fdff32f10f51b860eaae536c4cad572ff323923a708c3747
                                                                                                                                                                                                                                            • Instruction ID: 5940506ada7ed5ca7b3f9f44f9fd485eef5e7b2ef24ea6d690ca5e1218e35400
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 4feafb8df3604776fdff32f10f51b860eaae536c4cad572ff323923a708c3747
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 5E210932619A8182D640EF14E8913AEB7A4FBC9740FA05036E7CE83BA9CF3CC5118F10
                                                                                                                                                                                                                                            Function 00007FF72FA27850 Relevance: 1.5, APIs: 1, Instructions: 49COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: List
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 3841611558-0
                                                                                                                                                                                                                                            • Opcode ID: 8956e227aa5ab5da9cf308970846bdfe0494504f4735109df30137dc6bb559e4
                                                                                                                                                                                                                                            • Instruction ID: fbe7958c362aa62c495bdce9f04ba7dbb5cd7f0b6655805eb197e21adb1330b5
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 8956e227aa5ab5da9cf308970846bdfe0494504f4735109df30137dc6bb559e4
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 2A21B77260CAC586D660EB25E8906EBFBB0F7C9780F900026E6CD87A5ADF3CD5558F50
                                                                                                                                                                                                                                            Function 00007FF72FA6B530 Relevance: 1.5, APIs: 1, Instructions: 49COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Cpp_errorThrow__invalid_parameter_noinfostd::_
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 162856716-0
                                                                                                                                                                                                                                            • Opcode ID: 67eaaf632c04bac502c5b023ef6aa112b0b963ee9ba95430572186a15c55fbf8
                                                                                                                                                                                                                                            • Instruction ID: c5a6cd9ca9e1219312ba0e9b43d39ea6c792026d31f1e82aee5f12dc08488dac
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 67eaaf632c04bac502c5b023ef6aa112b0b963ee9ba95430572186a15c55fbf8
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: F521EC2261DA8582D650AF15E8512AEB7A4FBC5784F905036E7CD87BA9DF3CC5118F10
                                                                                                                                                                                                                                            Function 00007FF72FA05230 Relevance: 1.5, APIs: 1, Instructions: 46COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: std::bad_exception::bad_exception
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 2160870905-0
                                                                                                                                                                                                                                            • Opcode ID: 2c8de8d2120709ff85f5947a8979f66fb55353262ddb1d69e4b374c081043c6d
                                                                                                                                                                                                                                            • Instruction ID: c5ffe5d5138674e0586c827777c5388108f70b21a6ad9599a57d8eac47db00aa
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 2c8de8d2120709ff85f5947a8979f66fb55353262ddb1d69e4b374c081043c6d
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 91113A22B0DB8581EA10EB69F45476EE760FBC9B94F400425EA8D43B6ACEBCC0048B54
                                                                                                                                                                                                                                            Function 00007FF72FBAED80 Relevance: 1.5, APIs: 1, Instructions: 43COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Cpp_errorThrow__invalid_parameter_noinfostd::_
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 162856716-0
                                                                                                                                                                                                                                            • Opcode ID: 3ceceb02c1d6754601e9455bbbd5eaaf68a322f1312ee0387845c277c20b8440
                                                                                                                                                                                                                                            • Instruction ID: 96f567935d8187f619732edc2ec5307da1c135fb18ae1cdc785a5ba3f160032d
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 3ceceb02c1d6754601e9455bbbd5eaaf68a322f1312ee0387845c277c20b8440
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: DA111932619B8582D641EF22E8512AEB3A1FBC5B40F905436F68E87BA9DF3CD500CB10
                                                                                                                                                                                                                                            Function 00007FF72FA863D0 Relevance: 1.5, APIs: 1, Instructions: 43COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Cpp_errorThrow__invalid_parameter_noinfostd::_
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 162856716-0
                                                                                                                                                                                                                                            • Opcode ID: 32ac7d5414c13d1f83373ea37dca7086d42e664c7ec62b9d81ed263edfcc8cbc
                                                                                                                                                                                                                                            • Instruction ID: d0cb5fffafb4e78af4509bf92eb4af9b6f97bf12af605d230e6802be8a5d88f7
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 32ac7d5414c13d1f83373ea37dca7086d42e664c7ec62b9d81ed263edfcc8cbc
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 3911D432619B8582E600AF15E8553AEA661FBC9B44F905036E68E87BA9DE3CD914CF10
                                                                                                                                                                                                                                            Function 00007FF72FA86310 Relevance: 1.5, APIs: 1, Instructions: 43COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Cpp_errorThrow__invalid_parameter_noinfostd::_
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 162856716-0
                                                                                                                                                                                                                                            • Opcode ID: 835d9604bbce9bb73dccafe980037890b2bc1444ad3d5e76964f6e0f80dfa8c3
                                                                                                                                                                                                                                            • Instruction ID: 6707af86d59caf3dcf4b9b30d69c0fc3a96ed53dea00ab33c31e99278624a5cc
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 835d9604bbce9bb73dccafe980037890b2bc1444ad3d5e76964f6e0f80dfa8c3
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 1511D732619B8582E600AF15E8512AEB761FBC9B40F905036E68E867A9DF3CD514CF50
                                                                                                                                                                                                                                            Function 00007FF72FB7FAE0 Relevance: 1.5, APIs: 1, Instructions: 42COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Ref_count_baseRef_count_base::_std::_
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 1391782822-0
                                                                                                                                                                                                                                            • Opcode ID: b0097962b4dfde2aa14eab4b58734fd89c11c4c6999dc842a1ef436c9f199952
                                                                                                                                                                                                                                            • Instruction ID: 851db666ba606ac3e493288d52b3b90d31e9742241ace24a417285864a212f88
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: b0097962b4dfde2aa14eab4b58734fd89c11c4c6999dc842a1ef436c9f199952
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: F2119632619B8582D640EF19F85016EB7A5F7C8B80F501526EBCD87B6ADE38D4508F50
                                                                                                                                                                                                                                            Function 00007FF72FBFF28C Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 3215553584-0
                                                                                                                                                                                                                                            • Opcode ID: 48bb363744d182ba232372bc05be0a51e6b3cba4a4dbe6b332463a11a3904b04
                                                                                                                                                                                                                                            • Instruction ID: 8f6e3dc62baa94282018e7aca288c1991aa5b22133aed7cb1bb991cd09d20c31
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 48bb363744d182ba232372bc05be0a51e6b3cba4a4dbe6b332463a11a3904b04
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 7C11D672A14B569DEB10AFB0E8812ED37B4FB04358F900626EA4D12B59DF34D195C7A0
                                                                                                                                                                                                                                            Function 00007FF72FA35110 Relevance: 1.5, APIs: 1, Instructions: 39COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72FA3512D
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA20710: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72FA2072D
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Concurrency::details::EmptyQueue::StructuredWork
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 1865873047-0
                                                                                                                                                                                                                                            • Opcode ID: c3a641db7dd7e1f04b7392b439e6e1a5595cc6d9a5574f8ae2cc849b0075bd63
                                                                                                                                                                                                                                            • Instruction ID: 82afbbaccc91c2c10f9d6cabb528c4bc0da4634b99e2609f74872bbe3549b738
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: c3a641db7dd7e1f04b7392b439e6e1a5595cc6d9a5574f8ae2cc849b0075bd63
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: E311D63661DBC481CA60EB56E88005EBBA0F7C9BD8F444126FACD93B29CE2CD150CF40
                                                                                                                                                                                                                                            Function 00007FF72FB9CAF0 Relevance: 1.5, APIs: 1, Instructions: 39COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: FreeTask
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 734271698-0
                                                                                                                                                                                                                                            • Opcode ID: 1390414adff6cff9572c19d13d4af55dc9366da79f4f2d16f28cb309ed5a3294
                                                                                                                                                                                                                                            • Instruction ID: 0b140a9d2d74baaaafd5b8d73af09adb0e908b13818ac63cbed4fe2c6d064dec
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 1390414adff6cff9572c19d13d4af55dc9366da79f4f2d16f28cb309ed5a3294
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 4B11EC76628A9586E720EF25E85169EB3A1FBC4744F801121F6CD86A59DF3CE644CF10
                                                                                                                                                                                                                                            Function 00007FF72FC05AE0 Relevance: 1.5, APIs: 1, Instructions: 38memoryCOMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FC00E10: HeapAlloc.KERNEL32 ref: 00007FF72FC00E4E
                                                                                                                                                                                                                                            • RtlReAllocateHeap.NTDLL(?,?,00000000,00007FF72FBFA6A3,?,?,?,00007FF72FC001A3,?,?,?,00007FF72FC00099,?,?,?,00007FF72FC0047A), ref: 00007FF72FC05B4D
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Heap$AllocAllocate
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 2177240990-0
                                                                                                                                                                                                                                            • Opcode ID: a7367e38fab032233a23a9ca2fb40b7de6f33ae6bf9d1918b8aca198c58c2f55
                                                                                                                                                                                                                                            • Instruction ID: 31ec9c3f74e1d8d3ee24b3e1476592ffa9cf73a3213ccf695e6f912bba82907a
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: a7367e38fab032233a23a9ca2fb40b7de6f33ae6bf9d1918b8aca198c58c2f55
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 2401EC10B1C6C742FAA47B697D512F9D151DF44BA0FC84A39DD2D463C2ED2CF5828A34
                                                                                                                                                                                                                                            Function 00007FF72F9CB050 Relevance: 1.5, APIs: 1, Instructions: 36COMMONLIBRARYCODE
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72F9E2260: stdext::threads::lock_error::lock_error.LIBCPMTD ref: 00007FF72F9E2269
                                                                                                                                                                                                                                            • _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF72F9CB092
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: _invalid_parameter_noinfo_noreturnstdext::threads::lock_error::lock_error
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 414106306-0
                                                                                                                                                                                                                                            • Opcode ID: 7eaa5432c860693200022f1327d9c7e8a0ef9cad4840f8a3d96a02fa25242593
                                                                                                                                                                                                                                            • Instruction ID: 15004b6c55774a7f774852d0468abdc38afd1c0de0035c9ce5dbbf643f2e1851
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 7eaa5432c860693200022f1327d9c7e8a0ef9cad4840f8a3d96a02fa25242593
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 90015262B19F8581DA60AF29E84135AF394FB887A4F800631E5DD8279CDF2CD5108F14
                                                                                                                                                                                                                                            Function 00007FF72F9D4B10 Relevance: 1.5, APIs: 1, Instructions: 35COMMONLIBRARYCODE
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: LockitLockit::~_std::_
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 4141856610-0
                                                                                                                                                                                                                                            • Opcode ID: 4ed18daa84c5c558ccc116bd1d9ac16c48bdaac661717c99397de63d882cb418
                                                                                                                                                                                                                                            • Instruction ID: 4efb7b6c2a3fb983af492424b27819a6906cf5c8d44ae5aff6f359765270e3db
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 4ed18daa84c5c558ccc116bd1d9ac16c48bdaac661717c99397de63d882cb418
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: B9F03661F2978682DD48F756A85A8AEA350EF92B85FD02036F98F17B5FCD2CD0114B10
                                                                                                                                                                                                                                            Function 00007FF72F9D4F80 Relevance: 1.5, APIs: 1, Instructions: 34stringCOMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: ByteCharMultiWidestrrchr
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 276481755-0
                                                                                                                                                                                                                                            • Opcode ID: 61311b388f447272e06331baca643fbe0d43bc75db73e1357b66dad9377b3dc1
                                                                                                                                                                                                                                            • Instruction ID: ec2d042316799d0e8cff18468de470b0d8718792c86158b0a0f0bae50d1ad29a
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 61311b388f447272e06331baca643fbe0d43bc75db73e1357b66dad9377b3dc1
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: A501FE32A0C68186D230FB15E94526AB7A0F7C9748F600236E6CD87AADCF3DD5408F50
                                                                                                                                                                                                                                            Function 00007FF72F9FA8B0 Relevance: 1.5, APIs: 1, Instructions: 33COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72F9FA8F3
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72F9F2150: allocator.LIBCONCRTD ref: 00007FF72F9F216B
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Concurrency::details::EmptyQueue::StructuredWorkallocator
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 1755220593-0
                                                                                                                                                                                                                                            • Opcode ID: e630231634035eeb2ac7ec622e320c384590e5ca209c256a886902d53ca816f5
                                                                                                                                                                                                                                            • Instruction ID: 0a12b39459bbe6add3fd1dcd822e01e047e1c6a5ff185997d60cc02f2f7bea55
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: e630231634035eeb2ac7ec622e320c384590e5ca209c256a886902d53ca816f5
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 10015236619F8482CA60DB4AF89111EB7A4F7C9B94F504126EACD83B29DF3CD1618B40
                                                                                                                                                                                                                                            Function 00007FF72FB95DD0 Relevance: 1.5, APIs: 1, Instructions: 32COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72FB95DED
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA45CE0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72FA45CF1
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Concurrency::details::EmptyQueue::StructuredWork
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 1865873047-0
                                                                                                                                                                                                                                            • Opcode ID: f53a0104ca1699a1dff8dd9072ce108e638b513950ee8d3201b6f48fb5c4f35b
                                                                                                                                                                                                                                            • Instruction ID: 2977e536d4cf9d431dd53f02b0b0384a645ae1f077c0ed2a69fd1eefbcdb5e65
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: f53a0104ca1699a1dff8dd9072ce108e638b513950ee8d3201b6f48fb5c4f35b
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 81013076608B8486CB10DF1AE49165ABB70F7C9B85F508116EB8D43B28CF39D511CB40
                                                                                                                                                                                                                                            Function 00007FF72FA6FFE0 Relevance: 1.5, APIs: 1, Instructions: 31COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Name$NodeNode::
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 2544435820-0
                                                                                                                                                                                                                                            • Opcode ID: c5eb3d4471621ccbc52861cf316ed1686c60dd9bf9f3c63ff2dc3039ce938ba5
                                                                                                                                                                                                                                            • Instruction ID: 81b19d815a454b55c466b5b139800b8fa37286f622fb62336b17dba7fd2b3f05
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: c5eb3d4471621ccbc52861cf316ed1686c60dd9bf9f3c63ff2dc3039ce938ba5
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: EB01E972A08BC182DA10EB15E8416AEB3B0F7C6784FA04526EB8D43B69CF7DD501CF10
                                                                                                                                                                                                                                            Function 00007FF72FA3C410 Relevance: 1.5, APIs: 1, Instructions: 30COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: atomic
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 1039557753-0
                                                                                                                                                                                                                                            • Opcode ID: 9ca185a43521d589ea1ec58c1bf6d9d8244aa92ec9fc2ff649280413e46ebf07
                                                                                                                                                                                                                                            • Instruction ID: 2ca819ab1c738a3968f5e046c8996fb6e0fb755150ef74a2929aae0a175cb9e7
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 9ca185a43521d589ea1ec58c1bf6d9d8244aa92ec9fc2ff649280413e46ebf07
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: E7F0EC26629E8582CA50EB25E48149BB771FBC9B94B905222FA8E53B29DF38D5458F00
                                                                                                                                                                                                                                            Function 00007FF72FA4D800 Relevance: 1.5, APIs: 1, Instructions: 25COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: FromMonitorPoint
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 1566494148-0
                                                                                                                                                                                                                                            • Opcode ID: 9c796e21bcbbd32d9733918cfdc4da3585dd35d9ebd39644cbc39d00fd814335
                                                                                                                                                                                                                                            • Instruction ID: 06b7341b127c150ac1c28aae1bdc175700bc75188788317fdb60267d234f9534
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 9c796e21bcbbd32d9733918cfdc4da3585dd35d9ebd39644cbc39d00fd814335
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: F2F0FF32928E8586D212EF24E85129BF771FFD9784F505226F28E16A19DF3DD4858F40
                                                                                                                                                                                                                                            Function 00007FF72FA45FA0 Relevance: 1.5, APIs: 1, Instructions: 24COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: QueryRecycle
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 2469249176-0
                                                                                                                                                                                                                                            • Opcode ID: 934cc2852b4868eeabf2003547c0e9231da6ab5e154a758072a7bf41caf7e24a
                                                                                                                                                                                                                                            • Instruction ID: 0b7e728255db77c616a7847739a4364292423f7fcc741a1d01293672dc1b2cb1
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 934cc2852b4868eeabf2003547c0e9231da6ab5e154a758072a7bf41caf7e24a
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: C0F0F922E1CACA96EA50BB14E8407AAA371FB92740FD05031E54A02A94DF3CE549DF31
                                                                                                                                                                                                                                            Function 00007FF72F9D0F30 Relevance: 1.5, APIs: 1, Instructions: 21COMMONLIBRARYCODE
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • char_traits.LIBCPMTD ref: 00007FF72F9D0F5D
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72F9CB5D0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72F9CB609
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72F9CB5D0: char_traits.LIBCPMTD ref: 00007FF72F9CB68C
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: char_traits$Concurrency::details::EmptyQueue::StructuredWork
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 3215207624-0
                                                                                                                                                                                                                                            • Opcode ID: 439046dc0d3d0137d2424e1f1b116a87ab26bfc4525b92261c69718bc40d6492
                                                                                                                                                                                                                                            • Instruction ID: 8133d651359485bd28b31cd439aeabb61a9d922bb7ec0248f22dbb613ac49e73
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 439046dc0d3d0137d2424e1f1b116a87ab26bfc4525b92261c69718bc40d6492
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: E5E0AC62A1DAC581DA10FB25E8510AEA774FBCA7C4F904535EBCC43B6EDE2DC5518F10
                                                                                                                                                                                                                                            Function 00007FF72FA467B0 Relevance: 1.5, APIs: 1, Instructions: 20COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: EnumWindows
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 1129996299-0
                                                                                                                                                                                                                                            • Opcode ID: dbb1f573b530a87190cc711aa1b050e54dc1485b87a9a9082699a202dfc258a2
                                                                                                                                                                                                                                            • Instruction ID: 62a2174b4f9d41d6510d1e7d5a88959f1fb94fe9b03c5a1efe45284597e777c9
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: dbb1f573b530a87190cc711aa1b050e54dc1485b87a9a9082699a202dfc258a2
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 1EF0FE72A1C68592DA20EF14F84159AF770FBC5398F800221E68D46A69DF7CD649CF10
                                                                                                                                                                                                                                            Function 00007FF72F9D6C30 Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Func_classstd::bad_exception::bad_exception
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 3621584023-0
                                                                                                                                                                                                                                            • Opcode ID: 811ec457467a64cf29189dc53ead4d07727bd2a83de33478318602b153d018cd
                                                                                                                                                                                                                                            • Instruction ID: ba9594e3e5e456ae1abde2363fb0cf69883f118e29a7c47de5b0b2ca1dc30169
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 811ec457467a64cf29189dc53ead4d07727bd2a83de33478318602b153d018cd
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 9AE09222B18BC585DA10BB21EC5516EA360FBD5B84F904172EACD8776ACE2CD5159E10
                                                                                                                                                                                                                                            Function 00007FF72F9FA750 Relevance: 1.5, APIs: 1, Instructions: 14COMMONLIBRARYCODE
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: allocator
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 3447690668-0
                                                                                                                                                                                                                                            • Opcode ID: ca8ea317d2f0d3d8a457c87ee71f8fc3ecd25bbc83401d61203f0230f4211ce2
                                                                                                                                                                                                                                            • Instruction ID: 477a801862a2afd19d1058beca32b25858a11df383ae73601fa2cf02d9116e79
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: ca8ea317d2f0d3d8a457c87ee71f8fc3ecd25bbc83401d61203f0230f4211ce2
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 6DE09236618B8982DA109B05E48030AB3B4F3C9B84FA08125EBCC47B28CE3EC852CB00
                                                                                                                                                                                                                                            Function 00007FF72FA39BE0 Relevance: 1.5, APIs: 1, Instructions: 14comCOMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: CreateInstance
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 542301482-0
                                                                                                                                                                                                                                            • Opcode ID: 82772c17aba477afe5628f88038786c146a768299862a8ae95623a60e00681d5
                                                                                                                                                                                                                                            • Instruction ID: 445fa266e53a88adbfce1a71b3760f6fddd8efc03955c528d2fdd9713ddb294c
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 82772c17aba477afe5628f88038786c146a768299862a8ae95623a60e00681d5
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: EBE07E76A08B8482C710EF59F84008ABBB4FB99794F904526EACC02B28CF7CD1A5CF40
                                                                                                                                                                                                                                            Function 00007FF72FA051F0 Relevance: 1.5, APIs: 1, Instructions: 14COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: std::bad_exception::bad_exception
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 2160870905-0
                                                                                                                                                                                                                                            • Opcode ID: 538807674c2b62b83cc14448f59e4e7ee9826529f02db1ab9d2ac6221aa7cb14
                                                                                                                                                                                                                                            • Instruction ID: 47ae83e3db07745602c8c45fcd3b8da6729c6c6e5ef4e498e78fca7d21dec4a2
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 538807674c2b62b83cc14448f59e4e7ee9826529f02db1ab9d2ac6221aa7cb14
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: A3E0EC6261DA8581DA20EB1AF88056FE3B1FBC9794F401135FA8E43B2ADE7CC1108F14
                                                                                                                                                                                                                                            Function 00007FF72F9F7560 Relevance: 1.5, APIs: 1, Instructions: 13COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • Concurrency::details::_CancellationTokenState::TokenRegistrationContainer::_Node::_Node.LIBCONCRTD ref: 00007FF72F9F7578
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72F9FA750: allocator.LIBCONCRTD ref: 00007FF72F9FA77D
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Token$CancellationConcurrency::details::_Container::_NodeNode::_RegistrationState::allocator
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 1019807984-0
                                                                                                                                                                                                                                            • Opcode ID: 089cf0d0fd74c876231e6b99bd90c9b96fa28976d6a0ba44241daba988135eda
                                                                                                                                                                                                                                            • Instruction ID: 246136f0fc5364e13df0ca80841ef5e73f3070c4e5719423eb7f8c6117caebb0
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 089cf0d0fd74c876231e6b99bd90c9b96fa28976d6a0ba44241daba988135eda
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 44D06261A79A8181D644FB15E88145EA360FBC5B80F906525F6CE5362DCE28D0554F04
                                                                                                                                                                                                                                            Function 00007FF72FA643A0 Relevance: 1.5, APIs: 1, Instructions: 11COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • __std_fs_directory_iterator_open.LIBCPMT ref: 00007FF72FA643C5
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FBC75F8: FindClose.KERNEL32(?,?,?,?,?,00007FF72FA643CA), ref: 00007FF72FBC7619
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FBC75F8: FindFirstFileExW.KERNEL32 ref: 00007FF72FBC763B
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Find$CloseFileFirst__std_fs_directory_iterator_open
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 3791046848-0
                                                                                                                                                                                                                                            • Opcode ID: 85fdb631bab1a170bc59e4487b9b1b9b43ae0330781ff348048b17804e7260d1
                                                                                                                                                                                                                                            • Instruction ID: d0fca09495e1871755bd5c16d617e651b71508dfceaeb13a5809ccf9361dee76
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 85fdb631bab1a170bc59e4487b9b1b9b43ae0330781ff348048b17804e7260d1
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: C2D067A6A19B8481CA44EB12F88104AA764F7997C0F605425FA8D42B29DA38C1618B40
                                                                                                                                                                                                                                            Function 00007FF72F9CAF30 Relevance: 1.5, APIs: 1, Instructions: 9COMMONLIBRARYCODE
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: allocator
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 3447690668-0
                                                                                                                                                                                                                                            • Opcode ID: dec3b39dd94d1f2ea7fefd5dc669bf3bce3c72644ec74f011e531bc41841e9f6
                                                                                                                                                                                                                                            • Instruction ID: 550884350d3e9b0c317e949c08816853252f9a36ae49d58555fa3008ef67ba13
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: dec3b39dd94d1f2ea7fefd5dc669bf3bce3c72644ec74f011e531bc41841e9f6
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: D7C0E966A29B8581CA44EB16F88105AB764F7D8BC0F90A425EA8E43729DF68C1558B00
                                                                                                                                                                                                                                            Function 00007FF72F9CAF60 Relevance: 1.5, APIs: 1, Instructions: 9COMMONLIBRARYCODE
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: allocator
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 3447690668-0
                                                                                                                                                                                                                                            • Opcode ID: 263be013334641b4032aabf44553dde502a18f0c278bf710d10114a2551f6ba5
                                                                                                                                                                                                                                            • Instruction ID: d9eeacdc320715d20109305cfc9c44153673b2ec0875e54735d0e09d8120dcc9
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 263be013334641b4032aabf44553dde502a18f0c278bf710d10114a2551f6ba5
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 6AC0C9A6A29B8481CA44EB12F88101AB360F7C8BD0F809421EA8E43729CF28C0508B00
                                                                                                                                                                                                                                            Function 00007FF72F9F2150 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: allocator
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 3447690668-0
                                                                                                                                                                                                                                            • Opcode ID: b38892144783de22bbdec888d807a518e244027bd890d32a71b714e913b1ba30
                                                                                                                                                                                                                                            • Instruction ID: 3a27a850ff1a7e2b895162c96f3ad37b81562fc47f4365b5498da2e0bfd444f9
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: b38892144783de22bbdec888d807a518e244027bd890d32a71b714e913b1ba30
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: A5C0C966A29B85C1CA44EF12F88100AB360F7C9BC0F909421EA8E43729CF28C0508B00
                                                                                                                                                                                                                                            Function 00007FF72FBC75B8 Relevance: 1.5, APIs: 1, Instructions: 9fileCOMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: FileFindNext
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 2029273394-0
                                                                                                                                                                                                                                            • Opcode ID: 065cdcbe97f106e0eade9506be4ef307043f165ef828597f3074fb4363c91a61
                                                                                                                                                                                                                                            • Instruction ID: 0d64d4d4c572188dfdb4f48d21cd3802cc9c93a708ea61f9fdb09c2daab2a750
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 065cdcbe97f106e0eade9506be4ef307043f165ef828597f3074fb4363c91a61
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 8DC04824F1AA86C2E6583B7A6C862A692A0EB48700FE44030C10880650DE2CA1E68F32
                                                                                                                                                                                                                                            Function 00007FF72FC00E10 Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: AllocHeap
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 4292702814-0
                                                                                                                                                                                                                                            • Opcode ID: 1ab3abee0b0df280f6ea689347e8a0d30cae0e72a40c9bae681347ef5c9e1206
                                                                                                                                                                                                                                            • Instruction ID: ad7e016cd3154f0d7f415f0118e0a904436364ac4d26fcea0f4dcc02e268d55a
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 1ab3abee0b0df280f6ea689347e8a0d30cae0e72a40c9bae681347ef5c9e1206
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 18F03A11B492C241FA6437796C412F9D190DF88FB1FC90B38D97E952C2DE1CA5C28930
                                                                                                                                                                                                                                            Function 00007FF72F9DA4A0 Relevance: 1.3, APIs: 1, Instructions: 13COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: ByteCharMultiWide
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 626452242-0
                                                                                                                                                                                                                                            • Opcode ID: 0b0b72c7a2bbd2b06bfd941d9483a5493affec11b1419866e72d6a85d5fe652c
                                                                                                                                                                                                                                            • Instruction ID: fdfd325cd55a7cd79a777f028c622c707207aa79d297a5dde328031958124454
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 0b0b72c7a2bbd2b06bfd941d9483a5493affec11b1419866e72d6a85d5fe652c
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 08D05B71B08AC182D7207B75B81935AB7A1F7C4354F504224E6D9476E4DF3CC0458F40
                                                                                                                                                                                                                                            Function 00007FF72FA38C10 Relevance: 1.3, APIs: 1, Instructions: 6COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Uninitialize
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 3861434553-0
                                                                                                                                                                                                                                            • Opcode ID: 63a70c0b2080d31044b73d5fc0420380379576a7f457e1623dfecf2492aaa18f
                                                                                                                                                                                                                                            • Instruction ID: 2901bb7a8fa11adf2a14ea60b2b9e304510d1ede82d9946fd2f5d0782af8e25c
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 63a70c0b2080d31044b73d5fc0420380379576a7f457e1623dfecf2492aaa18f
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: C5B01239E15686C2C5043B7DBC8A0086220F799301FE0C030C14800110CE2C40EE4F10

                                                                                                                                                                                                                                            Non-executed Functions

                                                                                                                                                                                                                                            Function 00007FF72FA5CB80 Relevance: 28.3, APIs: 7, Strings: 9, Instructions: 321sleepfilenetworkCOMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Concurrency::details::EmptyQueue::StructuredWork$Sleepshared_ptr$FileTick$Char_traitsCountCount64DeleteDownloadtype_info::_name_internal_method
                                                                                                                                                                                                                                            • String ID: %s%s%s%s%s%s%s%s&%s%s%I64u$%ws\%ws$&evt_action=$&evt_src=fa_$&nocache=$&version=$4D802742-3099-9C0E-C19B-2A23EA1FC420$https://pcapp.store/pixel.gif?guid=$temp_event
                                                                                                                                                                                                                                            • API String ID: 2670538149-51839579
                                                                                                                                                                                                                                            • Opcode ID: 80d9c28df1d0c68875d164fc185e98b0e96230b1b2e9feee400c3cdd6aafaac9
                                                                                                                                                                                                                                            • Instruction ID: 4c2b422aad32e23add6df125ca6af2ac72a99d058b7c96f45ce87c7e098e7e5d
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 80d9c28df1d0c68875d164fc185e98b0e96230b1b2e9feee400c3cdd6aafaac9
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 7B02C232609AC195EA70AB14E8953EBB3A4FBC9740F904136D6CD82BAADF3CD554CF50
                                                                                                                                                                                                                                            Function 00007FF72FBCCD9C Relevance: 24.4, APIs: 16, Instructions: 377COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: LockitLockit::_std::_
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 3382485803-0
                                                                                                                                                                                                                                            • Opcode ID: bc1982defb8eac6dbef23eeeb8e29c9e44d69ad9987c82a9ef43d25c9a3d76a8
                                                                                                                                                                                                                                            • Instruction ID: 1ca0a6f1d4c87513f35b1f45b277e7f6093f73265b85ccfeee24d7ab3b17b77b
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: bc1982defb8eac6dbef23eeeb8e29c9e44d69ad9987c82a9ef43d25c9a3d76a8
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 81D1B216B095C658FA15BF75EC002FE9751DB547A4F880231EE2D076E5EE2CE887CB20
                                                                                                                                                                                                                                            Function 00007FF72FC0EACC Relevance: 10.7, APIs: 7, Instructions: 171COMMONLIBRARYCODE
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FC009FC: GetLastError.KERNEL32(?,?,00000001,00007FF72FBEFE31,?,?,?,?,?,?,?,?,00007FF72FBE8BFE,?,?,?), ref: 00007FF72FC00A0B
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FC009FC: FlsGetValue.KERNEL32(?,?,00000001,00007FF72FBEFE31,?,?,?,?,?,?,?,?,00007FF72FBE8BFE,?,?,?), ref: 00007FF72FC00A20
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FC009FC: SetLastError.KERNEL32(?,?,00000001,00007FF72FBEFE31,?,?,?,?,?,?,?,?,00007FF72FBE8BFE,?,?,?), ref: 00007FF72FC00AAB
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FC009FC: FlsSetValue.KERNEL32(?,?,00000001,00007FF72FBEFE31,?,?,?,?,?,?,?,?,00007FF72FBE8BFE,?,?,?), ref: 00007FF72FC00A41
                                                                                                                                                                                                                                            • GetUserDefaultLCID.KERNEL32(?,00000000,00000092,?), ref: 00007FF72FC0EC3C
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FC009FC: FlsSetValue.KERNEL32(?,?,00000001,00007FF72FBEFE31,?,?,?,?,?,?,?,?,00007FF72FBE8BFE,?,?,?), ref: 00007FF72FC00A6E
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FC009FC: FlsSetValue.KERNEL32(?,?,00000001,00007FF72FBEFE31,?,?,?,?,?,?,?,?,00007FF72FBE8BFE,?,?,?), ref: 00007FF72FC00A7F
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FC009FC: FlsSetValue.KERNEL32(?,?,00000001,00007FF72FBEFE31,?,?,?,?,?,?,?,?,00007FF72FBE8BFE,?,?,?), ref: 00007FF72FC00A90
                                                                                                                                                                                                                                            • EnumSystemLocalesW.KERNEL32(?,00000000,00000092,?,?,00000000,?,00007FF72FBFEF55), ref: 00007FF72FC0EC23
                                                                                                                                                                                                                                            • ProcessCodePage.LIBCMT ref: 00007FF72FC0EC66
                                                                                                                                                                                                                                            • IsValidCodePage.KERNEL32 ref: 00007FF72FC0EC78
                                                                                                                                                                                                                                            • IsValidLocale.KERNEL32 ref: 00007FF72FC0EC8E
                                                                                                                                                                                                                                            • GetLocaleInfoW.KERNEL32 ref: 00007FF72FC0ECEA
                                                                                                                                                                                                                                            • GetLocaleInfoW.KERNEL32 ref: 00007FF72FC0ED06
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Value$Locale$CodeErrorInfoLastPageValid$DefaultEnumLocalesProcessSystemUser
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 2591520935-0
                                                                                                                                                                                                                                            • Opcode ID: eceec71e99f726c791e96b7b45b04fcc779a6ef98558d0b13d0f1f302e7fef22
                                                                                                                                                                                                                                            • Instruction ID: 3b13c2e1e9f9cbfdaa125c6c4b79915b65aec30d53de2580956c4bc68b8a4369
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: eceec71e99f726c791e96b7b45b04fcc779a6ef98558d0b13d0f1f302e7fef22
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 227170A2B6869685FB15BB68EC506FCB3A4FF44744F844039CA1D53795EF3CA486CB20
                                                                                                                                                                                                                                            Function 00007FF72FBE8CB8 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 1239891234-0
                                                                                                                                                                                                                                            • Opcode ID: eb1eff54664d364fffe93d0073cbebfe185a6b11e3a872ea97b0a0592c0c5c65
                                                                                                                                                                                                                                            • Instruction ID: ee98d1c092e9eb6c78ced7148d11d818f0db9a48c696dc582c5f17b6bf821122
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: eb1eff54664d364fffe93d0073cbebfe185a6b11e3a872ea97b0a0592c0c5c65
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: F7314C32B18FC186EB209B39EC402EEB3A4FB88754F940139EA8D43B55DF38D5958B10
                                                                                                                                                                                                                                            Function 00007FF72FBC68B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41windowCOMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: FormatInfoLocaleMessage
                                                                                                                                                                                                                                            • String ID: !x-sys-default-locale
                                                                                                                                                                                                                                            • API String ID: 4235545615-2729719199
                                                                                                                                                                                                                                            • Opcode ID: 86d9eb462d90a40d0ec9a479c1aed245eb1ae8251b0789d64038f46ad7eeabbd
                                                                                                                                                                                                                                            • Instruction ID: b6349a856843de5cb6ec848b78747a3db5ce8194d724df00dcbfa7b9d04a30a8
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 86d9eb462d90a40d0ec9a479c1aed245eb1ae8251b0789d64038f46ad7eeabbd
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: DA018471B087C586E7219B36F950BAEA7A2FB88784F944035DA4D06B95CF3CD5458F10
                                                                                                                                                                                                                                            Function 00007FF72FBA6700 Relevance: 42.4, APIs: 1, Strings: 23, Instructions: 439COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72F9D11A0: _WChar_traits.LIBCPMTD ref: 00007FF72F9D11CD
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA198A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF72FA19930
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA198A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72FA1995D
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA198A0: shared_ptr.LIBCMTD ref: 00007FF72FA19993
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA198A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72FA19A2E
                                                                                                                                                                                                                                            • std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FF72FBA6EE9
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA17E60: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72FA17EF7
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Concurrency::details::EmptyQueue::StructuredWork$Char_traitsFac_nodeFac_node::_shared_ptrstd::_type_info::_name_internal_method
                                                                                                                                                                                                                                            • String ID: Caption$Description$HelpLink$HelpTelephone$IdentifyingNumber$InstallDate$InstallLocation$InstallSource$Language$LocalPackage$Name$PackageCache$PackageCode$PackageName$ProductID$RegCompany$RegOwner$SKUNumber$Transforms$URLInfoAbout$URLUpdateInfo$Vendor$Version
                                                                                                                                                                                                                                            • API String ID: 2107158585-605506046
                                                                                                                                                                                                                                            • Opcode ID: d51620f80b3453d859d737405456661cbbfd575a18e312c2bd03560603a0111e
                                                                                                                                                                                                                                            • Instruction ID: b0e29eb40097163160d123430cb375a67ccae628a9cac6634eb5f50965628366
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: d51620f80b3453d859d737405456661cbbfd575a18e312c2bd03560603a0111e
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 2132103264DAC2A1EA70FB14E8956EEA365FBC5340FC15136D6CC82AADEE2CD545CF10
                                                                                                                                                                                                                                            Function 00007FF72FA7D0A0 Relevance: 37.1, APIs: 15, Strings: 6, Instructions: 313windowCOMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Window$Concurrency::details::EmptyQueue::StructuredWorkshared_ptr$MetricsSystem$AssocChar_traitsCreateDecorator::getErrorExecuteFocusForegroundLastRectShellTableTypestd::ios_base::goodtype_info::_name_internal_method
                                                                                                                                                                                                                                            • String ID: $&eCode=%lu&br=default$C$open$product$showInCurrentBrowser_error
                                                                                                                                                                                                                                            • API String ID: 1779610432-685431900
                                                                                                                                                                                                                                            • Opcode ID: 302634dffdf3ba410fb82b6abff03a9fbe1b5f08755e51f4be15bb9a62030736
                                                                                                                                                                                                                                            • Instruction ID: c0b4691e5a82254aa8897a159d41d37d4b617f39ddf45c70dd63072bafce5597
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 302634dffdf3ba410fb82b6abff03a9fbe1b5f08755e51f4be15bb9a62030736
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 3B02F932609AC296E671EB24E8947EEF361FBC9744F805136D68D82AA9DF3CD544CF10
                                                                                                                                                                                                                                            Function 00007FF72FA26DF0 Relevance: 30.2, APIs: 16, Strings: 1, Instructions: 430COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Affinity::operator!=Concurrency::details::Hardwareshared_ptr$Lockitstd::_$GetfacetLockit::_Lockit::~_Mpunctstd::locale::_
                                                                                                                                                                                                                                            • String ID: 0123456789ABCDEFabcdef-+Xx
                                                                                                                                                                                                                                            • API String ID: 2889901185-2799312399
                                                                                                                                                                                                                                            • Opcode ID: 432d304fe1b6997aa18e4637ad5b94b336e2412e3285c0f1698c26b15de39032
                                                                                                                                                                                                                                            • Instruction ID: 1a8dfca6322aadd262669ef4972ebee0e6950ceab27474680f3c0416482ddfd5
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 432d304fe1b6997aa18e4637ad5b94b336e2412e3285c0f1698c26b15de39032
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: CC224D2270C6D585E671AB15EC907FFFBA0EBC6744F900036E6CD86AA9DE2CD5448F60
                                                                                                                                                                                                                                            Function 00007FF72FA62C20 Relevance: 28.4, APIs: 9, Strings: 7, Instructions: 388COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72F9D0F30: char_traits.LIBCPMTD ref: 00007FF72F9D0F5D
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA19AA0: type_info::_name_internal_method.LIBCMTD ref: 00007FF72FA19B51
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA19AA0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72FA19B8C
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA19AA0: shared_ptr.LIBCMTD ref: 00007FF72FA19BC8
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72F9D0E90: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72F9D0EAD
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA19580: shared_ptr.LIBCMTD ref: 00007FF72FA195B3
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA19580: shared_ptr.LIBCMTD ref: 00007FF72FA1963C
                                                                                                                                                                                                                                            • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72FA62E0E
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA5F990: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72FA5F9B2
                                                                                                                                                                                                                                            • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72FA62F67
                                                                                                                                                                                                                                            • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72FA62FF4
                                                                                                                                                                                                                                            • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72FA6300A
                                                                                                                                                                                                                                            • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72FA6304C
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA62250: Concurrency::details::VirtualProcessorRoot::GetSchedulerProxy.LIBCMTD ref: 00007FF72FA622BA
                                                                                                                                                                                                                                            • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72FA63090
                                                                                                                                                                                                                                            • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72FA631D9
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA17E60: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72FA17EF7
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Concurrency::details::$EmptyQueue::StructuredWork$shared_ptr$ProcessorProxyRoot::SchedulerVirtualchar_traitstype_info::_name_internal_method
                                                                                                                                                                                                                                            • String ID: SELECT url, title, visit_count, last_visit_time FROM urls$SELECT url, title, visit_count, last_visit_time/ 1000000 - 11644473600 AS last_visit_time FROM urls WHERE last_visit_time/ 1000000 - 11644473600 > %d ORDER BY last_visit_time DESC$\HRDR_History.sqlite$\Microsoft\Edge\User Data\Default\History$d$localappdata$temp
                                                                                                                                                                                                                                            • API String ID: 2671280029-3709265721
                                                                                                                                                                                                                                            • Opcode ID: 2fccfb0c2b307b7c3e2ce6dbe88d9239bb26f4cd6e381bb6a8a014095e47de39
                                                                                                                                                                                                                                            • Instruction ID: dbc7f5fac9b15339c567098273a1082de786b1d5dc02601d16dbcc77b38bd096
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 2fccfb0c2b307b7c3e2ce6dbe88d9239bb26f4cd6e381bb6a8a014095e47de39
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: B722C53261EAC191DA70FB15E8917EFA364FBC5780F805136E6CD82AAADE2CD544CF50
                                                                                                                                                                                                                                            Function 00007FF72F9FC7FD Relevance: 21.4, APIs: 11, Strings: 1, Instructions: 385COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72F9FF2E0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72F9FF2EE
                                                                                                                                                                                                                                            • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72F9FC9E2
                                                                                                                                                                                                                                            • Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 00007FF72F9FCA51
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Concurrency::details::Work$EmptyQueue::Structured$Base::ContextIdentityQueue
                                                                                                                                                                                                                                            • String ID: ":
                                                                                                                                                                                                                                            • API String ID: 416282553-3662656813
                                                                                                                                                                                                                                            • Opcode ID: 6a7b9d25337c0256520ace18c769387c56f9b1b84de30fc4a6c1f8208a841913
                                                                                                                                                                                                                                            • Instruction ID: 1ff3562a2cc5657f3d4dfff915eead124758cc004e2e00161f9f0283a3a1e3c9
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 6a7b9d25337c0256520ace18c769387c56f9b1b84de30fc4a6c1f8208a841913
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 4722A376609BC585DB70AB16E8943AEB3A1F7C9B84F804126DACD87B69DF2CC044CF54
                                                                                                                                                                                                                                            Function 00007FF72FA4CF90 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 140registryCOMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: CloseConcurrency::details::EmptyQueue::StructuredWorktype_info::_name_internal_method$Char_traitsOpenQueryValueshared_ptr
                                                                                                                                                                                                                                            • String ID: AppParam$Software\PCAppStore$default
                                                                                                                                                                                                                                            • API String ID: 569003908-3084650451
                                                                                                                                                                                                                                            • Opcode ID: 046cef3d8659dad396eb1e7e9f90fe91bd10f38256446210a4226fc4e57e831a
                                                                                                                                                                                                                                            • Instruction ID: 333ef82b341741ae0d54b8072210e7a71f9027700d0a6f4c5358533a714809e1
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 046cef3d8659dad396eb1e7e9f90fe91bd10f38256446210a4226fc4e57e831a
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: BA71E63261DAC195E670AB14E8917EBB364FBC5780F905532E6CD82AAADF2CD444CF50
                                                                                                                                                                                                                                            Function 00007FF72FA0CF40 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 186COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72F9D0E90: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72F9D0EAD
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA0A780: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72FA0A7F8
                                                                                                                                                                                                                                            • std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FF72FA0CFEB
                                                                                                                                                                                                                                            • std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FF72FA0D0A4
                                                                                                                                                                                                                                            • std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FF72FA0D121
                                                                                                                                                                                                                                            • std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FF72FA0D19E
                                                                                                                                                                                                                                            • std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FF72FA0D1E9
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72F9F7980: Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 00007FF72F9F7AE1
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Fac_nodeFac_node::_std::_$Concurrency::details::EmptyQueue::StructuredWork$Concurrency::details::_SchedulerScheduler::_swap
                                                                                                                                                                                                                                            • String ID: last_visit$title$url$visit_count
                                                                                                                                                                                                                                            • API String ID: 3419026931-3535738862
                                                                                                                                                                                                                                            • Opcode ID: 6c1546871798c304ed637bf94ec2ec67f02618bd18234d1640e87589197c6ee7
                                                                                                                                                                                                                                            • Instruction ID: 4f3a328a439d1de09b869e072bbfd6536b082ffa66925fcbbb30ac76fadd09a4
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 6c1546871798c304ed637bf94ec2ec67f02618bd18234d1640e87589197c6ee7
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: AC812221719AC595DA60EB10F8947EEE361FBD5780FC05036DA8D83BAEEE6CD605CB10
                                                                                                                                                                                                                                            Function 00007FF72FA7CCD0 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 173windowCOMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • ShellExecuteW.SHELL32 ref: 00007FF72FA7CD39
                                                                                                                                                                                                                                            • GetLastError.KERNEL32 ref: 00007FF72FA7CD4F
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72F9D11A0: _WChar_traits.LIBCPMTD ref: 00007FF72F9D11CD
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA198A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF72FA19930
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA198A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72FA1995D
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA198A0: shared_ptr.LIBCMTD ref: 00007FF72FA19993
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA198A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72FA19A2E
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA18E90: shared_ptr.LIBCMTD ref: 00007FF72FA18F05
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA18E90: shared_ptr.LIBCMTD ref: 00007FF72FA18F8E
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72F9D0510: UnDecorator::getVbTableType.LIBCMTD ref: 00007FF72F9D0551
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA18E90: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72FA19190
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA7D0A0: ShellExecuteW.SHELL32 ref: 00007FF72FA7D144
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA7D0A0: GetLastError.KERNEL32 ref: 00007FF72FA7D160
                                                                                                                                                                                                                                            • SetForegroundWindow.USER32 ref: 00007FF72FA7D05F
                                                                                                                                                                                                                                            • SetFocus.USER32 ref: 00007FF72FA7D06A
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Concurrency::details::EmptyQueue::StructuredWorkshared_ptr$ErrorExecuteLastShell$Char_traitsDecorator::getFocusForegroundTableTypeWindowtype_info::_name_internal_method
                                                                                                                                                                                                                                            • String ID: $&eCode=%lu&br=%ws$open$product$showInCurrentBrowser_error
                                                                                                                                                                                                                                            • API String ID: 376287392-1600046415
                                                                                                                                                                                                                                            • Opcode ID: b48f3cc171adeb5aa9864a815093cb0e89c198ecbc3383d46296a58e0c3c2b40
                                                                                                                                                                                                                                            • Instruction ID: c188c2f0ecc41551859363ef25bd647640c48a2a9e7bc372fc8933be513d41a5
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: b48f3cc171adeb5aa9864a815093cb0e89c198ecbc3383d46296a58e0c3c2b40
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 1A91D732619AC291EA60AB14E8917EEB360FBC9740F905536E6CD82BADDF3CD545CF10
                                                                                                                                                                                                                                            Function 00007FF72F9D2C70 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 52COMMONLIBRARYCODE
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Yarn$std::_$Locinfo::_Locinfo_ctorLockitLockit::_
                                                                                                                                                                                                                                            • String ID: bad locale name
                                                                                                                                                                                                                                            • API String ID: 3904239083-1405518554
                                                                                                                                                                                                                                            • Opcode ID: c8096dea473fa920a14d580e4e777e2a6771f5c3d34b2eb5396def71f0eaedc1
                                                                                                                                                                                                                                            • Instruction ID: 532c9572b03b5124f1ed08e7c425222454a0ecb544723dae2c7aad70fbf5a24f
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: c8096dea473fa920a14d580e4e777e2a6771f5c3d34b2eb5396def71f0eaedc1
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 35110052F0DB8642DD04FB69E8495AE9360EFC3B84FE01436EA8D5376ECE2DD4118B14
                                                                                                                                                                                                                                            Function 00007FF72FA46B40 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 76COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Concurrency::details::Decorator::getEmptyQueue::StructuredTableTypeWork$Concurrency::task_continuation_context::task_continuation_contextbool_std::ios_base::good
                                                                                                                                                                                                                                            • String ID: %5D=$s%5B
                                                                                                                                                                                                                                            • API String ID: 2106438023-2722900981
                                                                                                                                                                                                                                            • Opcode ID: 30185837c31f611c346255d2079aceefcf25eb75f45aaf82a75205d5218d50e7
                                                                                                                                                                                                                                            • Instruction ID: 79bd48445cf5c770a5ec4c7d09c5f337dd57c129044468e4ba2884c5ad556242
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 30185837c31f611c346255d2079aceefcf25eb75f45aaf82a75205d5218d50e7
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 12310A62B1CAC291EA10FB15E8416EAE760FFC5784FD05032E6CD86BAEDE2CD5048F10
                                                                                                                                                                                                                                            Function 00007FF72F9F6890 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 165COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: shared_ptr$Decorator::getTableType
                                                                                                                                                                                                                                            • String ID: d
                                                                                                                                                                                                                                            • API String ID: 2700986858-2564639436
                                                                                                                                                                                                                                            • Opcode ID: 2a443e44136db3e59683da2a643cd3e0ef56bc8aca3d512dfd3e58115b0b619b
                                                                                                                                                                                                                                            • Instruction ID: 9ab1a02e61836ef3a0d4aa8c6f04cc039fc134d8a3e7b548e0c946db7a3b18d3
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 2a443e44136db3e59683da2a643cd3e0ef56bc8aca3d512dfd3e58115b0b619b
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: D4810A22A1DBC185D760EB25E8502AFB7A1EBC9780F904135E6CE87B6ADE2CD444CF50
                                                                                                                                                                                                                                            Function 00007FF72FB98BE0 Relevance: 12.2, APIs: 8, Instructions: 233COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: allocator
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 3447690668-0
                                                                                                                                                                                                                                            • Opcode ID: 36a7d94fe0d72bb2d11dd43c1fe2a5c21703dc949e93bb453b0e81e27999111b
                                                                                                                                                                                                                                            • Instruction ID: fee76364605700a8d264613043ad18c0d883b0dd4ae616ac37024115028c3c30
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 36a7d94fe0d72bb2d11dd43c1fe2a5c21703dc949e93bb453b0e81e27999111b
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 25B11D2271DBC581DA709B25F8906AFE3A0FB89784F901136EACD47B69DF2CD6448F50
                                                                                                                                                                                                                                            Function 00007FF72FBF0E80 Relevance: 11.0, APIs: 3, Strings: 3, Instructions: 494COMMONLIBRARYCODE
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                            • String ID: f$p$p
                                                                                                                                                                                                                                            • API String ID: 3215553584-1995029353
                                                                                                                                                                                                                                            • Opcode ID: 6f4758e8455b3c582431fd9143ecc6f95f7555859754ceda06c37393b6817565
                                                                                                                                                                                                                                            • Instruction ID: 6a2be17a954831379f14f107eb959ce1244d5359678dc6b8b48ff06c1657ae46
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 6f4758e8455b3c582431fd9143ecc6f95f7555859754ceda06c37393b6817565
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: B4128F62F0D1C386FB20BA6598546FDF251FB80754FC84A35F68A86AC4DB3DE5908F24
                                                                                                                                                                                                                                            Function 00007FF72F9EABA0 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 238COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • OpenEventW.KERNEL32 ref: 00007FF72F9EB15E
                                                                                                                                                                                                                                            • SetEvent.KERNEL32 ref: 00007FF72F9EB184
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72F9D11A0: _WChar_traits.LIBCPMTD ref: 00007FF72F9D11CD
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA198A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF72FA19930
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA198A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72FA1995D
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA198A0: shared_ptr.LIBCMTD ref: 00007FF72FA19993
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA198A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72FA19A2E
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA18E90: shared_ptr.LIBCMTD ref: 00007FF72FA18F05
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA18E90: shared_ptr.LIBCMTD ref: 00007FF72FA18F8E
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA18E90: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72FA19190
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA526B0: RegCreateKeyW.ADVAPI32 ref: 00007FF72FA526ED
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA526B0: RegSetKeyValueW.ADVAPI32 ref: 00007FF72FA5275A
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA526B0: RegCloseKey.ADVAPI32 ref: 00007FF72FA52769
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA526B0: RegCloseKey.ADVAPI32 ref: 00007FF72FA527A4
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Concurrency::details::EmptyQueue::StructuredWorkshared_ptr$CloseEvent$Char_traitsCreateOpenValuetype_info::_name_internal_method
                                                                                                                                                                                                                                            • String ID: DEBUGSCREEN_EVENT$LastID$LastTime$LastTimeContextual
                                                                                                                                                                                                                                            • API String ID: 2367785588-2236634864
                                                                                                                                                                                                                                            • Opcode ID: 20fd1bb7345d8d0259f0059eaf424eaac3da0cff6d8924b2ba77ddd8d49548c0
                                                                                                                                                                                                                                            • Instruction ID: 69107e20b91930e49dc5768f9b239a9426c66badded56a194a5f6c47c284462a
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 20fd1bb7345d8d0259f0059eaf424eaac3da0cff6d8924b2ba77ddd8d49548c0
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 6FE19136609FC194D6B1AB15F8843DBB3A4FBC9790F905226DACC42B6DEF28D194CB50
                                                                                                                                                                                                                                            Function 00007FF72FB75010 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 216COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: List
                                                                                                                                                                                                                                            • String ID: product$system_panel_not_found
                                                                                                                                                                                                                                            • API String ID: 3841611558-2697177965
                                                                                                                                                                                                                                            • Opcode ID: d0161e24d586ff5193ecb13dd918c8b3e338a70176779a7cd8dfb7fd9bc6d1c5
                                                                                                                                                                                                                                            • Instruction ID: e011b33ca620644c4c61a8ac6cb924c3affbd5f9f4d0d0fc37c4c728271b6e55
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: d0161e24d586ff5193ecb13dd918c8b3e338a70176779a7cd8dfb7fd9bc6d1c5
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 9BB1B62261DAC591EA60AB15E8517EEB3A0FBC5780F805036E6CD87BAADF2CD445CF50
                                                                                                                                                                                                                                            Function 00007FF72F9F5042 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 147COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Mailbox
                                                                                                                                                                                                                                            • String ID: 5
                                                                                                                                                                                                                                            • API String ID: 1763892119-2226203566
                                                                                                                                                                                                                                            • Opcode ID: 886b7c52767595658aa0fd33b3f383513ea2a8cba9d0436adf2291bfa191cdc6
                                                                                                                                                                                                                                            • Instruction ID: a04191bd778d24b3f3ccd103381a4b2a3a25e84347144f392d54fa5086a7e7cc
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 886b7c52767595658aa0fd33b3f383513ea2a8cba9d0436adf2291bfa191cdc6
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 6161162271CAC585DB70DA15E8507ABA7A0F789794F840236EACD87BADDE6CC645CF00
                                                                                                                                                                                                                                            Function 00007FF72FC009FC Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • GetLastError.KERNEL32(?,?,00000001,00007FF72FBEFE31,?,?,?,?,?,?,?,?,00007FF72FBE8BFE,?,?,?), ref: 00007FF72FC00A0B
                                                                                                                                                                                                                                            • FlsGetValue.KERNEL32(?,?,00000001,00007FF72FBEFE31,?,?,?,?,?,?,?,?,00007FF72FBE8BFE,?,?,?), ref: 00007FF72FC00A20
                                                                                                                                                                                                                                            • FlsSetValue.KERNEL32(?,?,00000001,00007FF72FBEFE31,?,?,?,?,?,?,?,?,00007FF72FBE8BFE,?,?,?), ref: 00007FF72FC00A41
                                                                                                                                                                                                                                            • FlsSetValue.KERNEL32(?,?,00000001,00007FF72FBEFE31,?,?,?,?,?,?,?,?,00007FF72FBE8BFE,?,?,?), ref: 00007FF72FC00A6E
                                                                                                                                                                                                                                            • FlsSetValue.KERNEL32(?,?,00000001,00007FF72FBEFE31,?,?,?,?,?,?,?,?,00007FF72FBE8BFE,?,?,?), ref: 00007FF72FC00A7F
                                                                                                                                                                                                                                            • FlsSetValue.KERNEL32(?,?,00000001,00007FF72FBEFE31,?,?,?,?,?,?,?,?,00007FF72FBE8BFE,?,?,?), ref: 00007FF72FC00A90
                                                                                                                                                                                                                                            • SetLastError.KERNEL32(?,?,00000001,00007FF72FBEFE31,?,?,?,?,?,?,?,?,00007FF72FBE8BFE,?,?,?), ref: 00007FF72FC00AAB
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Value$ErrorLast
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 2506987500-0
                                                                                                                                                                                                                                            • Opcode ID: 877f7e7529951a5fe962d5eaf008cb7e755919cc2dd4325c5171c455dac9ed75
                                                                                                                                                                                                                                            • Instruction ID: dc701451f9041c99f71a7e22d525fe86d2b4758125752088a84d197b7bc699b2
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 877f7e7529951a5fe962d5eaf008cb7e755919cc2dd4325c5171c455dac9ed75
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 4F215C21B8C7C246F919736D7E551F9E292CF84FB0F854638D82D06AD6DE2CB4C24A20
                                                                                                                                                                                                                                            Function 00007FF72FA58CD0 Relevance: 9.1, APIs: 6, Instructions: 122COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Concurrency::details::EmptyQueue::StructuredWork$task$Is_slash_oper::operatorstd::_
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 486407804-0
                                                                                                                                                                                                                                            • Opcode ID: bb53db32546f82d92d363147a9617a1d03cccc331413cda37523311cc3d5db75
                                                                                                                                                                                                                                            • Instruction ID: 4325ba0224ed3cc5ff66312322cd1c8ec099b5c43fe59fa75063b326e5d8894b
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: bb53db32546f82d92d363147a9617a1d03cccc331413cda37523311cc3d5db75
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: CF51F122B1DBC581DA60AB16E8906AAE7B0F7C97C4F504035EECD87B69DE3CD4458F10
                                                                                                                                                                                                                                            Function 00007FF72FA10840 Relevance: 9.1, APIs: 6, Instructions: 109COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Concurrency::details::EmptyQueue::StructuredWorkallocator
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 1755220593-0
                                                                                                                                                                                                                                            • Opcode ID: b0bd36a96c2f4c2c263ee2cb34ef02ea68d7f027693ecf5d0632ff105d701230
                                                                                                                                                                                                                                            • Instruction ID: be10cba459a0eb0c16f5f196c600c889aa1a829104a8a14c105fb15121d50c13
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: b0bd36a96c2f4c2c263ee2cb34ef02ea68d7f027693ecf5d0632ff105d701230
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 8851A436609FC981DA60AB16E89126FB7B4F789BC4F505126EACD87B69DF2CC1108F10
                                                                                                                                                                                                                                            Function 00007FF72FC00B74 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • GetLastError.KERNEL32(?,?,?,00007FF72FBE90F9,?,?,?,?,00007FF72FC00E08), ref: 00007FF72FC00B83
                                                                                                                                                                                                                                            • FlsSetValue.KERNEL32(?,?,?,00007FF72FBE90F9,?,?,?,?,00007FF72FC00E08), ref: 00007FF72FC00BB9
                                                                                                                                                                                                                                            • FlsSetValue.KERNEL32(?,?,?,00007FF72FBE90F9,?,?,?,?,00007FF72FC00E08), ref: 00007FF72FC00BE6
                                                                                                                                                                                                                                            • FlsSetValue.KERNEL32(?,?,?,00007FF72FBE90F9,?,?,?,?,00007FF72FC00E08), ref: 00007FF72FC00BF7
                                                                                                                                                                                                                                            • FlsSetValue.KERNEL32(?,?,?,00007FF72FBE90F9,?,?,?,?,00007FF72FC00E08), ref: 00007FF72FC00C08
                                                                                                                                                                                                                                            • SetLastError.KERNEL32(?,?,?,00007FF72FBE90F9,?,?,?,?,00007FF72FC00E08), ref: 00007FF72FC00C23
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Value$ErrorLast
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 2506987500-0
                                                                                                                                                                                                                                            • Opcode ID: 6e2b04699322a0b5cfd42af5a9a2b6f92e0ba9cae776432ea4546de978c54102
                                                                                                                                                                                                                                            • Instruction ID: 24d0cadc2eca076cf405b856ae79da2dbe3f361b4823853c492e59bf0a2d1cc3
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 6e2b04699322a0b5cfd42af5a9a2b6f92e0ba9cae776432ea4546de978c54102
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 7B114C20B8C7C246F919776D7E511F9E151DF84FB0F850638D82E06AC6DE6CB4C28E20
                                                                                                                                                                                                                                            Function 00007FF72F9FC96B Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 85COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • shared_ptr.LIBCMTD ref: 00007FF72F9FC97D
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA00E80: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72FA00E8E
                                                                                                                                                                                                                                            • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72F9FC9E2
                                                                                                                                                                                                                                            • Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 00007FF72F9FCA51
                                                                                                                                                                                                                                            • Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 00007FF72F9FCABF
                                                                                                                                                                                                                                            • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72F9FCB88
                                                                                                                                                                                                                                            • Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 00007FF72F9FCBF7
                                                                                                                                                                                                                                            • Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 00007FF72F9FCC65
                                                                                                                                                                                                                                            • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72F9FCD1C
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Concurrency::details::Work$Base::ContextEmptyIdentityQueueQueue::Structured$shared_ptr
                                                                                                                                                                                                                                            • String ID: ":
                                                                                                                                                                                                                                            • API String ID: 1420614328-3662656813
                                                                                                                                                                                                                                            • Opcode ID: 8473d83d3ebdd20010ffa6d884846ecc031746852bc7a06e646e4d13fd1cf8aa
                                                                                                                                                                                                                                            • Instruction ID: d517a632a24defd8981ae0f0015f94a1bcfed628452e0f4f7426a4e04de105ce
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 8473d83d3ebdd20010ffa6d884846ecc031746852bc7a06e646e4d13fd1cf8aa
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 0441A166719BC585CA70AB16E8943AEB3A1F7C9B84F804126DACD83B69DF3CC440CF14
                                                                                                                                                                                                                                            Function 00007FF72FA1CCE0 Relevance: 7.7, APIs: 5, Instructions: 248COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Decorator::getTableTypestd::ios_base::good$Count64Tick
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 2303708893-0
                                                                                                                                                                                                                                            • Opcode ID: 27a03b2dbf7fc3cae0a6d0f9ccb6143c9721fc24dc4c615e33674755bc98e386
                                                                                                                                                                                                                                            • Instruction ID: c5c3f7a72f7cd49d38c7d42d079e14acaecf8bc67b662c94b1d0e1880fc62433
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 27a03b2dbf7fc3cae0a6d0f9ccb6143c9721fc24dc4c615e33674755bc98e386
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: BFE17E36609FC995DAB19B19F8803DEB3A4F789790F404126DACD83B69EF38C154CB10
                                                                                                                                                                                                                                            Function 00007FF72F9EC7C0 Relevance: 7.7, APIs: 5, Instructions: 204COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: fpos
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 1083263101-0
                                                                                                                                                                                                                                            • Opcode ID: 9476c9bc91792789987b66b2f23cc2085d9c935f74b1f1327633b4182b0acec4
                                                                                                                                                                                                                                            • Instruction ID: fd8144c803268aeae74cee4076bd97857a6b13b1b7caf0a5dcb5ad3fed6b31e0
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 9476c9bc91792789987b66b2f23cc2085d9c935f74b1f1327633b4182b0acec4
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: C6A1DC22B0CAC585EA71EA19E8413AAE7A0F7C5794F540136EADEC7B99DF2CD444CF10
                                                                                                                                                                                                                                            Function 00007FF72FC02878 Relevance: 7.7, APIs: 5, Instructions: 196COMMONLIBRARYCODE
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: _set_statfp
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 1156100317-0
                                                                                                                                                                                                                                            • Opcode ID: 9adc40d30be0667ea822cfcd186048a49ebbed58f705be398f9b93e066ac2796
                                                                                                                                                                                                                                            • Instruction ID: e53f73a9c490c099f5b130ba90c88cf41305d96f37edc3d75ec7a3eaf29721c9
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 9adc40d30be0667ea822cfcd186048a49ebbed58f705be398f9b93e066ac2796
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: E181D812B0CAC645F632AE3DBC402FAE650FF55794F944239E94E26598DF3CA5C28E20
                                                                                                                                                                                                                                            Function 00007FF72FA1A8B0 Relevance: 7.6, APIs: 5, Instructions: 132COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Decorator::getTableType$shared_ptr$Concurrency::details::EmptyEventOpenQueue::StructuredWork
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 2612416502-0
                                                                                                                                                                                                                                            • Opcode ID: 132bb4f05331553b23e435c9935aff854f526115cd742e7eb351bcbd426d0ae7
                                                                                                                                                                                                                                            • Instruction ID: c6576902e7350c0c1352e4420e45a80b4a9a32a879da959141c852fdb6442f76
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 132bb4f05331553b23e435c9935aff854f526115cd742e7eb351bcbd426d0ae7
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 5F61C632A09BC581DA60AB59F8857AFA360FBC5B84F905036DACD53B6EDE2CD0558B10
                                                                                                                                                                                                                                            Function 00007FF72FBDCFDC Relevance: 7.6, APIs: 5, Instructions: 109COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 459529453-0
                                                                                                                                                                                                                                            • Opcode ID: d1f11d321af7514c15d9f406e790c9804a163d0b549e51b58ad6f87ffa14eb88
                                                                                                                                                                                                                                            • Instruction ID: ac65e10c2a5c6d882715bcbd46e10c13460a978c2f025d27211e3bd9102e1c32
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: d1f11d321af7514c15d9f406e790c9804a163d0b549e51b58ad6f87ffa14eb88
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: FE41A521B09AC685EA05BF25EC501FDA360FF89B94F880132DA5E477A5DF3CE556CB20
                                                                                                                                                                                                                                            Function 00007FF72FA329B0 Relevance: 7.6, APIs: 5, Instructions: 87COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 00007FF72FA329F1
                                                                                                                                                                                                                                            • Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FF72FA32A5B
                                                                                                                                                                                                                                            • Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FF72FA32A82
                                                                                                                                                                                                                                            • Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FF72FA32ABB
                                                                                                                                                                                                                                            • Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FF72FA32AE5
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Concurrency::details::_CriticalLock::_ReentrantScoped_lockScoped_lock::~_$Affinity::operator!=Concurrency::details::Hardware
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 2104388542-0
                                                                                                                                                                                                                                            • Opcode ID: d8385314d93121b3063a5f2a95450edc81f565393832bc5af18c111b4efef671
                                                                                                                                                                                                                                            • Instruction ID: c8420e9c620cfc4e4113ad7720908dc4b042a9d08830752c80d584440b36e299
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: d8385314d93121b3063a5f2a95450edc81f565393832bc5af18c111b4efef671
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 0E41D332608AC691DA30EB15E8917EFF7A0FBD5384F905132E6CD83A6ADE28D545CF50
                                                                                                                                                                                                                                            Function 00007FF72FBDCDAC Relevance: 7.6, APIs: 5, Instructions: 82COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 459529453-0
                                                                                                                                                                                                                                            • Opcode ID: 50c47a8827274f38c0f3736f1fd31936bd58678a38fb0b5f20a044c21de0f8e4
                                                                                                                                                                                                                                            • Instruction ID: f0cad50b52b20f119a6f4f21f1081203d63138f011357e44aa2ee8b90a081b76
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 50c47a8827274f38c0f3736f1fd31936bd58678a38fb0b5f20a044c21de0f8e4
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 8931C2A1B08BC285FB15BF25EC401FDE360EB44BA4F880132DA1D57695EE3CF4868B20
                                                                                                                                                                                                                                            Function 00007FF72FBDCC94 Relevance: 7.6, APIs: 5, Instructions: 82COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 459529453-0
                                                                                                                                                                                                                                            • Opcode ID: 112ef0c315e20e2054934979971a74747d28e4e212307bb4f418f860236442e9
                                                                                                                                                                                                                                            • Instruction ID: 381913b1e0e926daa4d01ab8949d594c19e80769434ddffbe62de12334a90027
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 112ef0c315e20e2054934979971a74747d28e4e212307bb4f418f860236442e9
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 03317061B09AC695FA15BF29EC401FDE760FF54BA4F880132DE0D476A5EE3CE4418B20
                                                                                                                                                                                                                                            Function 00007FF72FBDCB7C Relevance: 7.6, APIs: 5, Instructions: 82COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 459529453-0
                                                                                                                                                                                                                                            • Opcode ID: 8b745b776ee2ab6c54a138dea4e9225d467cfc7b9e310386dac253dcf8aef9dd
                                                                                                                                                                                                                                            • Instruction ID: 9d6bf53b0479cdfa91e4f0e1f725061cbffe184bfb84bf6fa9f330ce0ac691f2
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 8b745b776ee2ab6c54a138dea4e9225d467cfc7b9e310386dac253dcf8aef9dd
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 41319261B09AC645FA05BF29EC401FDE360EB54BA4F9C0132DE1D47695EE3CE4868B60
                                                                                                                                                                                                                                            Function 00007FF72FBDCA64 Relevance: 7.6, APIs: 5, Instructions: 82COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 459529453-0
                                                                                                                                                                                                                                            • Opcode ID: 63525796fdc614a763654d78af5e4c6ab4c04918d32a8d8595e6cf0cd31b4a55
                                                                                                                                                                                                                                            • Instruction ID: 52731269be6222cd00659a82e4ba49a0f0d2c12c5d04780b6955acf1b8b68b92
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 63525796fdc614a763654d78af5e4c6ab4c04918d32a8d8595e6cf0cd31b4a55
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: DA318565B09AC685FA05FF25EC401FDE350EF54BA4F980132DE1D476A5EE7CE4868B20
                                                                                                                                                                                                                                            Function 00007FF72FBDC94C Relevance: 7.6, APIs: 5, Instructions: 82COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 459529453-0
                                                                                                                                                                                                                                            • Opcode ID: 3d39fdf089caf426e7ef7d541427a841507834602ff0a0aca71822c8087d7a2d
                                                                                                                                                                                                                                            • Instruction ID: 142a576e6bcb3e804657783e8e48da766da68c866ca75d9583202d8d12b5237d
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 3d39fdf089caf426e7ef7d541427a841507834602ff0a0aca71822c8087d7a2d
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: CF31A662B09AC685FA05FF29EC401FDE360EB54BA4F880132DD5D47695EE3CE546CB20
                                                                                                                                                                                                                                            Function 00007FF72FBDC834 Relevance: 7.6, APIs: 5, Instructions: 82COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 459529453-0
                                                                                                                                                                                                                                            • Opcode ID: d09422a78ec8ad162e7fea0cbddae09837ff0d52f406ea0c1072090de57cd303
                                                                                                                                                                                                                                            • Instruction ID: 356849228e61fcec5d94cb2ecb8b0a5e53ea18a5cebcbdf070fe055345ec9a0d
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: d09422a78ec8ad162e7fea0cbddae09837ff0d52f406ea0c1072090de57cd303
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: C4317261B09AC685FA05BF25EC405FDE350EF54BA4F880132DA4D47695EE3CE586CB20
                                                                                                                                                                                                                                            Function 00007FF72FBDCEC4 Relevance: 7.6, APIs: 5, Instructions: 81COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 459529453-0
                                                                                                                                                                                                                                            • Opcode ID: 068b1c0e13995d3bb25b6ae7d09f438031ac356ec0162791c5b29fddeb1f9623
                                                                                                                                                                                                                                            • Instruction ID: 307fa6152d3df80b78c02716fac01ffc9e4b93b3fee72fa6eb3cb9483daf61d5
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 068b1c0e13995d3bb25b6ae7d09f438031ac356ec0162791c5b29fddeb1f9623
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 9831A561B09AC685FA05BF25EC401FDE360EF54BA4F980132DE5D476E5EE3CE4868B20
                                                                                                                                                                                                                                            Function 00007FF72FC08734 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: _set_statfp
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 1156100317-0
                                                                                                                                                                                                                                            • Opcode ID: 7783eb11ce6aeccc52dcaec98f4ae3c4f4dee0f9b344835f90093a4934bb58c0
                                                                                                                                                                                                                                            • Instruction ID: a76fdb4276f7880b5fa6065ff58dc1e163d72172cb9ca2b73015a49110cfece2
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 7783eb11ce6aeccc52dcaec98f4ae3c4f4dee0f9b344835f90093a4934bb58c0
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: B3118B26F8CA8205F664312CFC417F99441EF583B4EC88638FA6E066DECE5CA9C34920
                                                                                                                                                                                                                                            Function 00007FF72FC00C3C Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • FlsGetValue.KERNEL32(?,?,?,00007FF72FBE8C47,?,?,00000000,00007FF72FBE8EE2,?,?,?,?,?,00007FF72FBE8E6E), ref: 00007FF72FC00C5B
                                                                                                                                                                                                                                            • FlsSetValue.KERNEL32(?,?,?,00007FF72FBE8C47,?,?,00000000,00007FF72FBE8EE2,?,?,?,?,?,00007FF72FBE8E6E), ref: 00007FF72FC00C7A
                                                                                                                                                                                                                                            • FlsSetValue.KERNEL32(?,?,?,00007FF72FBE8C47,?,?,00000000,00007FF72FBE8EE2,?,?,?,?,?,00007FF72FBE8E6E), ref: 00007FF72FC00CA2
                                                                                                                                                                                                                                            • FlsSetValue.KERNEL32(?,?,?,00007FF72FBE8C47,?,?,00000000,00007FF72FBE8EE2,?,?,?,?,?,00007FF72FBE8E6E), ref: 00007FF72FC00CB3
                                                                                                                                                                                                                                            • FlsSetValue.KERNEL32(?,?,?,00007FF72FBE8C47,?,?,00000000,00007FF72FBE8EE2,?,?,?,?,?,00007FF72FBE8E6E), ref: 00007FF72FC00CC4
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Value
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 3702945584-0
                                                                                                                                                                                                                                            • Opcode ID: e012d1f0fc226da98b08fa96183952b1416b1304989c7724abd204c002f722bd
                                                                                                                                                                                                                                            • Instruction ID: 76970a960e23dad4941751e8e2dc1d845e804f6c271d7b2a58bc3296fd444fbc
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: e012d1f0fc226da98b08fa96183952b1416b1304989c7724abd204c002f722bd
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 62111A60B4C7C255FA59B32DBE511F9E181DF84FB0F954339E82D06AD6DE2CE4C28A21
                                                                                                                                                                                                                                            Function 00007FF72FC00AD0 Relevance: 7.6, APIs: 5, Instructions: 50COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Value
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 3702945584-0
                                                                                                                                                                                                                                            • Opcode ID: a90712a97c21c0d449c0227400bbda50314ec9c37b23ccfd698bbaad28ac511f
                                                                                                                                                                                                                                            • Instruction ID: 7fb3850616e24da56d72940a8df64943ef4c3baccfba1febadd2a8674a78e14d
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: a90712a97c21c0d449c0227400bbda50314ec9c37b23ccfd698bbaad28ac511f
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 4811D660B8D38705F969B26D7C651F9A191CF84F74F99463CD93E0A6D2DD2CB4C24A30
                                                                                                                                                                                                                                            Function 00007FF72FA20B60 Relevance: 7.5, APIs: 5, Instructions: 40COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: shared_ptr$allocator$Affinity::operator!=Concurrency::details::Hardware
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 1053258265-0
                                                                                                                                                                                                                                            • Opcode ID: bf900db0225d2997dfbe73a8c34333cd34f5afa503cc0d13a924f7e3f71c0d2a
                                                                                                                                                                                                                                            • Instruction ID: 87ee1ace963030efe70f1aca12e2a93310cbe10f5c132594ea59624fec1d053d
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: bf900db0225d2997dfbe73a8c34333cd34f5afa503cc0d13a924f7e3f71c0d2a
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 4211032260CBC581DA60AB11F841AAFA774FBC6784F808132EACD47B6EDF3CD5548B50
                                                                                                                                                                                                                                            Function 00007FF72FA02F70 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 401COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Mpunct$std::ios_base::width
                                                                                                                                                                                                                                            • String ID: @
                                                                                                                                                                                                                                            • API String ID: 1355946870-2766056989
                                                                                                                                                                                                                                            • Opcode ID: feb5bb1277de20edab85baf608c87eddbf8699d1ef625deaf1cd65feaac4cc2a
                                                                                                                                                                                                                                            • Instruction ID: 65e35841fecdd6198e43a5488616787446213cfde6f349c6a156f27d7c54050e
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: feb5bb1277de20edab85baf608c87eddbf8699d1ef625deaf1cd65feaac4cc2a
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 6712052670DAC585DAB0AB15F8943EBA7A1F7C9780F844036DACD83BA9DE3CD545CB10
                                                                                                                                                                                                                                            Function 00007FF72FC04768 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                            • String ID: UTF-16LEUNICODE$UTF-8$ccs
                                                                                                                                                                                                                                            • API String ID: 3215553584-1196891531
                                                                                                                                                                                                                                            • Opcode ID: cb76a8c633e42a35513abc0c8eba2d28fb341af133972ce7828b83f61b038737
                                                                                                                                                                                                                                            • Instruction ID: 6eb3322a9af6cc7a885f234012fe6c64b08a0ae008af2932eecc51a5d1b42df6
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: cb76a8c633e42a35513abc0c8eba2d28fb341af133972ce7828b83f61b038737
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 8C81D572F0C2C285F7647F2DAB002FAA6A5EB11B54FD54039CA0953285DA3DE9839F21
                                                                                                                                                                                                                                            Function 00007FF72F9F5040 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 125COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Mailbox
                                                                                                                                                                                                                                            • String ID: 5
                                                                                                                                                                                                                                            • API String ID: 1763892119-2226203566
                                                                                                                                                                                                                                            • Opcode ID: 87770dd7e9f571f2986278d7a610b280d713e51eb297ed83aa80651aeca5b4b1
                                                                                                                                                                                                                                            • Instruction ID: 53bb637843286f830939ed061393265bef9ba6e9a00e1f48e8ec20f373c77914
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 87770dd7e9f571f2986278d7a610b280d713e51eb297ed83aa80651aeca5b4b1
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: B7512B2270CAC585DB709A15E8507EBA7A0F7C9794F844235EACD83BACDE6CD645CF00
                                                                                                                                                                                                                                            Function 00007FF72F9E5000 Relevance: 6.1, APIs: 4, Instructions: 145COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Concurrency::details::EmptyQueue::StructuredWorkfrexplswprintf
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 2911421839-0
                                                                                                                                                                                                                                            • Opcode ID: 2e42126a31bf4853d41c0c640862009aec23354457a15abcbf439dd886f10093
                                                                                                                                                                                                                                            • Instruction ID: e49a8b97fe68527fb53340274a8d528ca93a4f5c5d302c537e1db172b86100d9
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 2e42126a31bf4853d41c0c640862009aec23354457a15abcbf439dd886f10093
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: DE71073260DAC589D671AB25E8503EAF7A0EBC5790F504126E6CD82BAEDE2CD544CF50
                                                                                                                                                                                                                                            Function 00007FF72F9ECB70 Relevance: 6.1, APIs: 4, Instructions: 144COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: fpos
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 1083263101-0
                                                                                                                                                                                                                                            • Opcode ID: 324bcf03c9d9d573fb62d07e462846c406423958ac91c0845e5633d1312c6c31
                                                                                                                                                                                                                                            • Instruction ID: 197962f63810f19efadf0aaff3c04c02b0d515f30e8edca0c1d7a88d1783c09b
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 324bcf03c9d9d573fb62d07e462846c406423958ac91c0845e5633d1312c6c31
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 6261D12271CAC186E661AA19E8513AAB7A0F7C5794F540232EADDC7BADCF2CD444CF10
                                                                                                                                                                                                                                            Function 00007FF72FA588F0 Relevance: 6.1, APIs: 4, Instructions: 135COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Concurrency::details::EmptyIs_slash_oper::operatorQueue::StructuredWorkstd::_
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 569396444-0
                                                                                                                                                                                                                                            • Opcode ID: 87bbc430b2869bc34d2962cd5498185e9f2368d437da48860d56406be183ffe0
                                                                                                                                                                                                                                            • Instruction ID: 5c829889e5e56523085dcf8ddc1a52695ee5d920f344c043183ead7d71513c08
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 87bbc430b2869bc34d2962cd5498185e9f2368d437da48860d56406be183ffe0
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 4261FB22A1DAC585DA50AB15F8907EAB7B0FBC5784F901032F6CE87BA9DE2CD545CF10
                                                                                                                                                                                                                                            Function 00007FF72FA6CC30 Relevance: 6.1, APIs: 4, Instructions: 82COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Cpp_errorThrow_std::_$CancelCloseCurrentHandleThreadbool_shared_ptr
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 3093343528-0
                                                                                                                                                                                                                                            • Opcode ID: 4ef8de572ed1f1f70c74484de002ab0e309cf2b1b7d2cce3d2da03e174d9b014
                                                                                                                                                                                                                                            • Instruction ID: df31e0a5ef1edbc497bf4492cfe0b16b79cc2b90ec9adee9a9a786aa92493db2
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 4ef8de572ed1f1f70c74484de002ab0e309cf2b1b7d2cce3d2da03e174d9b014
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 1C311022B0CBCA81DB11BB1AE8457AEA771FF82B84F904035E68D4776ADE2CD4418F10
                                                                                                                                                                                                                                            Function 00007FF72FA32800 Relevance: 6.1, APIs: 4, Instructions: 79COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FF72FA32886
                                                                                                                                                                                                                                            • Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FF72FA328AD
                                                                                                                                                                                                                                            • Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FF72FA328E3
                                                                                                                                                                                                                                            • Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FF72FA3290A
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Concurrency::details::_CriticalLock::_ReentrantScoped_lockScoped_lock::~_
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 2443641946-0
                                                                                                                                                                                                                                            • Opcode ID: 864e10653a6bb1982f66181eec793958d4befb51fa1d7588dc549e19882c75cf
                                                                                                                                                                                                                                            • Instruction ID: 31a507e2d32a1af0599eac2ca77abac78b57b9a786ecd44429a53e43839fd9ef
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 864e10653a6bb1982f66181eec793958d4befb51fa1d7588dc549e19882c75cf
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 2141C422608AC591DA60EB15E8903EFF7B0FBC5784F905132E6CD83A6ADE2CD545CF50
                                                                                                                                                                                                                                            Function 00007FF72FA7CB90 Relevance: 6.1, APIs: 4, Instructions: 69COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: std::ios_base::good$Concurrency::details::_CriticalHandleLock::_ReentrantScoped_lockScoped_lock::~_
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 1863006881-0
                                                                                                                                                                                                                                            • Opcode ID: 749c20c281a9e2f9b96af624646f2169fd129f566b08e980573cde30b5ae49e2
                                                                                                                                                                                                                                            • Instruction ID: bc28b8ec5b36506abeab7705da212da7204840bb082f2eb98813cdab6906d655
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 749c20c281a9e2f9b96af624646f2169fd129f566b08e980573cde30b5ae49e2
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 81311B22A1DAC592EA50EB55F8415AEE374FBC5780F901536FACD83B69DF2CD4148F10
                                                                                                                                                                                                                                            Function 00007FF72FA33060 Relevance: 6.1, APIs: 4, Instructions: 59COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Lockitstd::_$Lockit::_Lockit::~_$Getfacetstd::locale::_
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 228209623-0
                                                                                                                                                                                                                                            • Opcode ID: 0ee62ac8da644a8bdc502f371de1206b0058b269cc232f85e15fba94a77f93c7
                                                                                                                                                                                                                                            • Instruction ID: d68823840fe3c4b639ffe7f16fa7efefce493eb6d9d45a2e289a2d76aa22fc4f
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 0ee62ac8da644a8bdc502f371de1206b0058b269cc232f85e15fba94a77f93c7
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 0521F42261DAC591DA50AB15F8816AAF770FBD57A4F901132F6CD43BA9DE3CD540CF10
                                                                                                                                                                                                                                            Function 00007FF72FA32F50 Relevance: 6.1, APIs: 4, Instructions: 59COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Lockitstd::_$Lockit::_Lockit::~_$Getfacetstd::locale::_
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 228209623-0
                                                                                                                                                                                                                                            • Opcode ID: ee95b762b0cf94fc72d457ec374968ca4aff422890421fcd6926c44d14f9877b
                                                                                                                                                                                                                                            • Instruction ID: d8b3b2304ba4b562ddfe35009372de576f2a2dded06f2a0982c987560189f00e
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: ee95b762b0cf94fc72d457ec374968ca4aff422890421fcd6926c44d14f9877b
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 8021FE2261DAC581DA50AB15E8816AAF7B0FBD57A4F901232F6CE43BA9DE3CD540CF10
                                                                                                                                                                                                                                            Function 00007FF72FA04770 Relevance: 6.1, APIs: 4, Instructions: 59COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Lockitstd::_$Lockit::_Lockit::~_$Getfacetstd::locale::_
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 228209623-0
                                                                                                                                                                                                                                            • Opcode ID: 5bd86b6ee14fb5578fa9d144295b878a568803309e18ae9be339bf8383b4f5fc
                                                                                                                                                                                                                                            • Instruction ID: 65d663c4158960d58e34270eeb72a7c1d8222e1c550b8804e0800279e00c6a18
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 5bd86b6ee14fb5578fa9d144295b878a568803309e18ae9be339bf8383b4f5fc
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 71210122A1CAC581DA50AB24F8806AAF770FB957A4F901136FA9D43BB9DE3CD554CF10
                                                                                                                                                                                                                                            Function 00007FF72FA3ADC0 Relevance: 6.1, APIs: 4, Instructions: 56COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: ConditionMask$InfoVerifyVersion
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 2793162063-0
                                                                                                                                                                                                                                            • Opcode ID: ca6a0869207d72d33c9b7a660a3a7bea133d9399d10461ba54ec6bb84780c07d
                                                                                                                                                                                                                                            • Instruction ID: 4275ea2be0569ae26d0143c68d7bf07cc8c416ee7ae28d2942d24460aa59d17f
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: ca6a0869207d72d33c9b7a660a3a7bea133d9399d10461ba54ec6bb84780c07d
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 69213C7661C2C086D360CF24F8583ABB7A0FB88744F501035E68987BA8EB7DC544CF50
                                                                                                                                                                                                                                            Function 00007FF72FA44AE0 Relevance: 6.0, APIs: 4, Instructions: 25COMMONLIBRARYCODE
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Concurrency::details::EmptyQueue::StructuredWorkswap
                                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                                            • API String ID: 3764174498-0
                                                                                                                                                                                                                                            • Opcode ID: 64c375c45fcf1574e63375e0e74c0897d23ff7183afb565a4982bf000894ce30
                                                                                                                                                                                                                                            • Instruction ID: 413ca88f0dc13746edcc325fbffa69a197ea696d5f9eb955d9a6dcca6dfbff29
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 64c375c45fcf1574e63375e0e74c0897d23ff7183afb565a4982bf000894ce30
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 27F0A962A08A8181CA20FB16F85515EE7A0FBC97C8F944536EACD87B6ECE2CC5518F50
                                                                                                                                                                                                                                            Function 00007FF72F9E0B10 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 350COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Mpunctstd::ios_base::width
                                                                                                                                                                                                                                            • String ID: @
                                                                                                                                                                                                                                            • API String ID: 1954291571-2766056989
                                                                                                                                                                                                                                            • Opcode ID: 997515416741cf959efb3b34e25fde1cf9d3743d8eac816919851e3ea18c34b2
                                                                                                                                                                                                                                            • Instruction ID: ee09493e7642c4a7387c71cdf2a0a81fbc889595e8ce28233682dc8d8f767e80
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 997515416741cf959efb3b34e25fde1cf9d3743d8eac816919851e3ea18c34b2
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: B102D43261DAC985DAB0AB15E8943EEA361F7C8B80F844532DACD83B6DDE7CD545CB40
                                                                                                                                                                                                                                            Function 00007FF72F9C2A50 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 243COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72F9D10B0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72F9D10CD
                                                                                                                                                                                                                                            • std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FF72F9C2F59
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Concurrency::details::EmptyFac_nodeFac_node::_Queue::StructuredWorkstd::_
                                                                                                                                                                                                                                            • String ID: $@
                                                                                                                                                                                                                                            • API String ID: 3399187363-1077428164
                                                                                                                                                                                                                                            • Opcode ID: 1a5ddf236e8deb30ed3e5205f91f9015913aed6f6c072ffa3dfa67636d82aa8e
                                                                                                                                                                                                                                            • Instruction ID: 40fb90c09c516031c00416d3cd1e117ef609393a7401120a502db3498bf7e58e
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 1a5ddf236e8deb30ed3e5205f91f9015913aed6f6c072ffa3dfa67636d82aa8e
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 6FD1A432649BC695EAB0AB54F8913DAB3A4F789744F805126D6CC83B69EF3CC544CF50
                                                                                                                                                                                                                                            Function 00007FF72F9C48A0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 243COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72F9D10B0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72F9D10CD
                                                                                                                                                                                                                                            • std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FF72F9C4DA9
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Concurrency::details::EmptyFac_nodeFac_node::_Queue::StructuredWorkstd::_
                                                                                                                                                                                                                                            • String ID: $@
                                                                                                                                                                                                                                            • API String ID: 3399187363-1077428164
                                                                                                                                                                                                                                            • Opcode ID: afd78bd069a519d036f72f4c74c00ac3bec2adb641e20f274b18443d4a834661
                                                                                                                                                                                                                                            • Instruction ID: 4f5aff282621ce2abc618b6a52382922c26dae8ba1970035b92d2163b7330a59
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: afd78bd069a519d036f72f4c74c00ac3bec2adb641e20f274b18443d4a834661
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 66D1A372649BC695EA70AB54F8913EAB3A4FB89344F805126D6CC83B69EF3CC544CF50
                                                                                                                                                                                                                                            Function 00007FF72FA30F05 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 216COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Concurrency::cancellation_token::_FromImpl
                                                                                                                                                                                                                                            • String ID: object key$object separator
                                                                                                                                                                                                                                            • API String ID: 2278334151-2279923633
                                                                                                                                                                                                                                            • Opcode ID: f46b7e787fcbf46f295cec9262e28ba246f18b7607bfbb222b1eb3d36f79fe4c
                                                                                                                                                                                                                                            • Instruction ID: 12f73dd667000b2c455721ab5ac9a42f2005554b7a7cb2adee55cbe9524c0822
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: f46b7e787fcbf46f295cec9262e28ba246f18b7607bfbb222b1eb3d36f79fe4c
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: D2B1E42260DAC584EA70AB15E8517EFF3A0EB86784F904132E6CD87B9ADF2CD544CF50
                                                                                                                                                                                                                                            Function 00007FF72FA3A800 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 161COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72F9D11A0: _WChar_traits.LIBCPMTD ref: 00007FF72F9D11CD
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA198A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF72FA19930
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA198A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72FA1995D
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA198A0: shared_ptr.LIBCMTD ref: 00007FF72FA19993
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA198A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72FA19A2E
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72F9D10B0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72F9D10CD
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA52420: RegCreateKeyW.ADVAPI32 ref: 00007FF72FA52470
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA52420: strrchr.LIBCMTD ref: 00007FF72FA52487
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA52420: RegQueryValueExW.KERNEL32 ref: 00007FF72FA524D3
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA52420: RegCloseKey.KERNEL32 ref: 00007FF72FA524ED
                                                                                                                                                                                                                                            • std::ios_base::good.LIBCPMTD ref: 00007FF72FA3A9E1
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            • Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 00007FF72FA3A821
                                                                                                                                                                                                                                            • Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run, xrefs: 00007FF72FA3A888
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Concurrency::details::EmptyQueue::StructuredWork$Char_traitsCloseCreateQueryValueshared_ptrstd::ios_base::goodstrrchrtype_info::_name_internal_method
                                                                                                                                                                                                                                            • String ID: Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run$Software\Microsoft\Windows\CurrentVersion\Run
                                                                                                                                                                                                                                            • API String ID: 3056597930-377293507
                                                                                                                                                                                                                                            • Opcode ID: 42fee92660e3c39e967fa928c55b6d12442245b2863bc5fb6c505304b03d466e
                                                                                                                                                                                                                                            • Instruction ID: f99c6179a11ecbb7f51fce1e80e16b819aebfc4a17701fb193687e6705c93bc0
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 42fee92660e3c39e967fa928c55b6d12442245b2863bc5fb6c505304b03d466e
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 5781E53261DAC185E670AB15E8507EBB7A4FBC9784F904236E6CD82B9ADF2CD544CF10
                                                                                                                                                                                                                                            Function 00007FF72FBD2760 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 102COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Getvals
                                                                                                                                                                                                                                            • String ID: false$true
                                                                                                                                                                                                                                            • API String ID: 1336808981-2658103896
                                                                                                                                                                                                                                            • Opcode ID: 9bfd9e52466e6b8764001f54716f7211cc612cc24da903296ea230ddcf9fb1b8
                                                                                                                                                                                                                                            • Instruction ID: f69588dc1d06a7ac6c280f3d28a3201f01df5feae1b5ec35b21383bf1668fbae
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 9bfd9e52466e6b8764001f54716f7211cc612cc24da903296ea230ddcf9fb1b8
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 63417C22F18A819AF710DF74E8402ED73B1FB88748B805226EE4D27A49EF38D596C750
                                                                                                                                                                                                                                            Function 00007FF72FA46940 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 90COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA51CD0: Concurrency::cancellation_token::_FromImpl.LIBCPMTD ref: 00007FF72FA51CFD
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA51CD0: Concurrency::cancellation_token::_FromImpl.LIBCPMTD ref: 00007FF72FA51D35
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72F9D0F30: char_traits.LIBCPMTD ref: 00007FF72F9D0F5D
                                                                                                                                                                                                                                            • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72FA46ACE
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Concurrency::cancellation_token::_FromImpl$Concurrency::details::EmptyQueue::StructuredWorkchar_traits
                                                                                                                                                                                                                                            • String ID: parse error$parse_error
                                                                                                                                                                                                                                            • API String ID: 3940763495-1820534363
                                                                                                                                                                                                                                            • Opcode ID: 0be3776a7a483cc6db7a160186439ac5a551f2d255295488c593d7cff802ba90
                                                                                                                                                                                                                                            • Instruction ID: 923bf34ef4adb74331cbadd672698ec2ab8bcfbfa77a8c00fe886fe56a0c2d61
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 0be3776a7a483cc6db7a160186439ac5a551f2d255295488c593d7cff802ba90
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: D841C33260DAC595DAA0AB15E8917EAB360F7C5380F904126E6CD83B69DF3CD559CF40
                                                                                                                                                                                                                                            Function 00007FF72FA3A6B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            • GetUserDefaultUILanguage.KERNEL32 ref: 00007FF72FA3A6DE
                                                                                                                                                                                                                                            • LCIDToLocaleName.KERNEL32 ref: 00007FF72FA3A6FD
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72F9D11A0: _WChar_traits.LIBCPMTD ref: 00007FF72F9D11CD
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA198A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF72FA19930
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA198A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72FA1995D
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA198A0: shared_ptr.LIBCMTD ref: 00007FF72FA19993
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA198A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF72FA19A2E
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA18E90: shared_ptr.LIBCMTD ref: 00007FF72FA18F05
                                                                                                                                                                                                                                              • Part of subcall function 00007FF72FA18E90: shared_ptr.LIBCMTD ref: 00007FF72FA18F8E
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: shared_ptr$Concurrency::details::EmptyQueue::StructuredWork$Char_traitsDefaultLanguageLocaleNameUsertype_info::_name_internal_method
                                                                                                                                                                                                                                            • String ID: unknown
                                                                                                                                                                                                                                            • API String ID: 3795742680-2904991687
                                                                                                                                                                                                                                            • Opcode ID: e8dfa364da66b7c623a9335613bcb925a68bd535dd1179b3a39ff12e803448eb
                                                                                                                                                                                                                                            • Instruction ID: f6e5ea875002d510968622d7d11bf83b10e30aae1f7cd5c88b5c6ab852aed05c
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: e8dfa364da66b7c623a9335613bcb925a68bd535dd1179b3a39ff12e803448eb
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: AB31D832A18A8596E620EB14E8856ABF770FBC5784F901136E6CD82AADDF3CD544CF10
                                                                                                                                                                                                                                            Function 00007FF72FA8EA80 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON
                                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                                            • Source File: 0000000B.00000002.3542526226.00007FF72F9C1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF72F9C0000, based on PE: true
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3540650739.00007FF72F9C0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3560071091.00007FF72FC2B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3563399550.00007FF72FC72000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3565605077.00007FF72FC73000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3567863420.00007FF72FC88000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3569838432.00007FF72FC8A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC8F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3571677497.00007FF72FC99000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            • Associated: 0000000B.00000002.3575651513.00007FF72FC9C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                            • Snapshot File: hcaresult_11_2_7ff72f9c0000_PcAppStore.jbxd
                                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                                            • API ID: Concurrency::details::_SchedulerScheduler::_operator==
                                                                                                                                                                                                                                            • String ID: 2
                                                                                                                                                                                                                                            • API String ID: 2641387182-450215437
                                                                                                                                                                                                                                            • Opcode ID: 1b7f05f116f92b6de5d85c8295a0d517e06cf233a030622378eca3cac154414a
                                                                                                                                                                                                                                            • Instruction ID: 6e86c2df2f72e0c15c7122fa4c5b25a73f286b29c6aadd83e4d1619ddb04e96b
                                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 1b7f05f116f92b6de5d85c8295a0d517e06cf233a030622378eca3cac154414a
                                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 1A11473261CAC582DA60EB55E8812EAF3A0FBC9784F804132E6CD87A99DF7CD5408F40